Critical Remote Code Execution via ProFTPD mod_sql SQL Injection (CVE‑2026‑42167)
What It Is — ProFTPD’s optional mod_sql module logs FTP activity using a user‑supplied filename that is inserted into an SQL statement. A flaw in the module’s escaping routine allows an attacker, after authenticating, to craft a filename that breaks out of the INSERT and injects a second SQL statement. When the backend is PostgreSQL with a super‑user role, the injected statement can invoke COPY … TO PROGRAM, executing an arbitrary OS command and yielding remote code execution.
Exploitability — The vulnerability is publicly disclosed with a working remote exploit (EDB‑ID 52658). No authentication beyond a valid FTP login is required, and the attack works against default configurations that enable mod_sql with a PostgreSQL backend. CVSS ≥ 9.0 (critical) based on remote code execution, network‑only vector, and high impact.
Affected Products — ProFTPD 1.3.7 and later when compiled with the mod_sql module and configured to use a PostgreSQL backend.
Why It Matters for Compliance & Audit Readiness
- Control Mapping: The flaw highlights gaps in your change‑management and configuration‑control processes—key SOC 2 CC6.1 (Change Management) and CC7.1 (System Operations) controls.
- Continuous Evidence: Demonstrating timely patching and hardening of FTP services requires automated evidence collection; a missed patch can be a material audit finding.
- Due Diligence: Enterprise customers increasingly demand proof that you monitor and remediate critical vulnerabilities as part of your SOC 2 readiness posture.
Recommended Actions
- Patch Immediately – Upgrade to the latest ProFTPD release that includes the fix for CVE‑2026‑42167.
- Review Configuration – Disable
mod_sqlif not required, or restrict its use to least‑privilege database accounts. - Log & Monitor – Enable detailed FTP audit logging and set up alerts for anomalous
STORcommands or unexpected database activity. - Map to SOC 2 Controls – Record the remediation in your change‑management system and capture the patch‑deployment evidence for SOC 2 audit reviewers.