PT-2026-37238 · Proftpd · Proftpd

Xs1Kveroa · Published 2026-05-05 · Updated 2026-05-13 · CVE-2026-44331

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ProFTPD versions prior to 1.3.9a 7666224

Description A SQL injection issue exists in the sqltab fetch clients cb() function within contrib/mod wrap2 sql.c. When the "UseReverseDNS on" setting is enabled, a remote attacker can inject arbitrary SQL commands by using a crafted domain name during a reverse DNS lookup, as the hostname is passed into SQL queries without being escaped. The exploitability of this issue may be limited by the character restrictions inherent to DNS names.

Recommendations Update to version 1.3.9a 7666224 or later. Disable the "UseReverseDNS" setting to prevent the processing of reverse DNS lookups.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2026-06340

CVE-2026-44331

OESA-2026-2264

OESA-2026-2265

OESA-2026-2266

OESA-2026-2267

OESA-2026-2268

Affected Products

Proftpd

References · 27

• https://osv.dev/vulnerability/DEBIAN-CVE-2026-44331 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2265 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42167 · Security Note
• https://ubuntu.com/security/CVE-2026-44331 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-44331 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2266 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06340 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44331 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2268 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2267 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-44331 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-44331 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2264 · Vendor Advisory
• https://github.com/NixOS/nixpkgs/pull/517211 · Note
• https://github.com/proftpd/proftpd/issues/2057 · Note