Debian/proftpd-dfsg: high 8.1
mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backen
Action: Upgrade proftpd-dfsg to 1.3.8.c+dfsg-4+deb13u2 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.3.8.c+dfsg-4+deb13u2 | - |
Fixed versions
| 1.3.8.c+dfsg-4+deb13u2 |
Sources
- osv: DEBIAN-CVE-2026-42167#Debian:13/proftpd-dfsg
- https://security-tracker.debian.org/tracker/CVE-2026-42167
published · modified · JSON