proftpd Vulnerabilities and Affected Products

Open in search

Explore source-attributed vulnerabilities associated with proftpd products.

Products

Showing 8 vulnerabilities on this page

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

ProFTPD mod_sftp Signed Integer Overflow via SCP Size-Record Parser

ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the mod_sftp module's SCP size-record parser that allows authenticated low-privilege attackers to bypass ASLR by sending a crafted file size value of UINT64_MAX, which results in a negative off_t value. Attackers can exploit the subsequent conversion to uint32_t, causing an approximately 4 GB requested read length and forcing the server to read beyond the end of the SSH channel data and write overread process…

CWE-126CWE-190Jul 20, 2026
CVSS7.1v4.0EPSS0.295%PoCs0SignalsSTIX

ProFTPD mod_sftp Heap Buffer Overflow via SFTP Packet Reassembly

ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp module that allows authenticated low-privilege attackers to achieve arbitrary code execution by sending crafted SFTP packet fragments exceeding the 16 KB reassembly buffer in the fxp.c component. Attackers can supply oversized fragments to trigger an incorrectly conditioned reallocation, corrupt pool freelist metadata, overwrite the root_fs BSS global pointer to reference a fake filesystem str…

CWE-122Jul 20, 2026
CVSS8.7v4.0EPSS0.502%PoCs0SignalsSTIX

ProFTPD SQL Injection in sqltab_fetch_clients_cb via Reverse DNS Lookup

In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltab_fetch_clients_cb() in contrib/mod_wrap2_sql.c allows a remote attacker to inject arbitrary SQL commands via a crafted domain name that is accessed in a reverse DNS lookup. When "UseReverseDNS on" is enabled, the attacker-supplied hostname is passed unescaped into SQL queries. The character restrictions of DNS names may affect exploitability.

CWE-89May 5, 2026
CVSS8.1v3.1EPSS0.455%PoCs0SignalsSTIX

proftpd proftpd Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).

CWE-89Apr 28, 20261 related artifact
CVSS8.1v3.1EPSS4.28%PoCs6SignalsSTIX

ProFTPD 1.3.7a - Remote Denial of Service

ProFTPD 1.3.7a contains a denial of service vulnerability that allows attackers to overwhelm the server by creating multiple simultaneous FTP connections. Attackers can repeatedly establish connections using threading to exhaust server connection limits and block legitimate user access.

CWE-770Jan 21, 2026
CVSS8.7v4.0EPSS0.538%PoCs1SignalsSTIX

ProFTPD 1.3.3c Backdoor Command Execution

A malicious backdoor was embedded in the official ProFTPD 1.3.3c source tarball distributed between November 28 and December 2, 2010. The backdoor implements a hidden FTP command trigger that, when invoked, causes the server to execute arbitrary shell commands with root privileges. This allows remote, unauthenticated attackers to run any OS command on the FTP server host.

CWE-912Aug 20, 20251 related artifact
CVSS9.3v4.0EPSS5.09%PoCs3SignalsSTIX

ProFTPD ≤ 1.3.8b - Privilege Escalation via mod_sql

In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access to GID 0 because of the lack of supplemental groups from mod_sql.

CWE-863Nov 29, 20241 related artifact
CVSS7.5v3.1EPSS2.2%PoCs0SignalsSTIX

ProFTPD Response API Remote Code Execution

Use-after-free vulnerability in the Response API in ProFTPD before 1.3.3g allows remote authenticated users to execute arbitrary code via vectors involving an error that occurs after an FTP data transfer.

CWE-399Dec 6, 2011
CVSS9.0v2.0EPSS12.6%PoCs0SignalsSTIX