ProFTPD CVE-2026-42167 SQL Injection and SFTP Buffer Overflow Advisory

Vulnerability Overview SQL Injection Vulnerability: In version 1.3.18rc2, an SQL injection vulnerability (CVE-2026-42167) exists, affecting the processing of and variables. SFTP Packet Buffer Overflow: In version 1.3.18rc3, an SFTP packet buffer overflow vulnerability (Issue #2199) exists, impacting authentication sessions. ExecEnvion Directive Regression: In version 1.3.18rc3, a regression issue related to the handling of the directive exists (Issue #2135). Scope of Impact SQL Injection Vulnerability: Affects all ProFTPD servers running version 1.3.18rc2. SFTP Packet Buffer Overflow: Affects all ProFTPD servers running version 1.3.18rc3, particularly those with SFTP functionality enabled. ExecEnvion Directive Regression: Affects all ProFTPD servers running version 1.3.18rc3, particularly those utilizing the directive. Remediation SQL Injection Vulnerability: The SQL injection vulnerability (CVE-2026-42167) was fixed in version 1.3.18rc1. SFTP Packet Buffer Overflow: The SFTP packet buffer overflow vulnerability (Issue #2199) was fixed in version 1.3.18rc3. ExecEnvion Directive Regression: The regression issue related to directive handling (Issue #2135) was fixed in version 1.3.18rc3. POC or Exploit Code No specific POC code or exploit code is included in the page. Additional Important Information Multi-module Support: Version 1.3.18rc1 added support for multiple modules, including and . New Directive: Version 1.3.18rc1 introduced the directive, used to configure the hash algorithm for SSH key fingerprints. Extended Log Class Enhancements: In version 1.3.18rc1, the directive now supports finer-grained logging, allowing the exclusion of specific commands from logging. SQLAuthTypes: In version 1.3.18rc1, the directive now supports "salted SHA1" passwords (SSHA) and passwords supported by liboauth ("Sodium"). TCPNoDelay: In version 1.3.18rc1, ProFTPD disables the TCP Nagle algorithm by default, but it can be configured separately for control and data transfer connections. The above information summarizes the key vulnerability details from the webpage screenshot.

Goal Reached Thanks to every supporter — we hit 100%!

ProFTPD CVE-2026-42167 SQL Injection and SFTP Buffer Overflow Advisory

More from this source