github.com
https://github.com/proftpd/proftpd/commit/766622456440fbca33abd7927c523673a11d1ed1 CVE-2026-44331
HIGH
ProFTPD SQL Injection in sqltab_fetch_clients_cb via Reverse DNS Lookup
Record summary
CVE-2026-44331 has a selected CVSS score of 8.1 (high).
Description
In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltab_fetch_clients_cb() in contrib/mod_wrap2_sql.c allows a remote attacker to inject arbitrary SQL commands via a crafted domain name that is accessed in a reverse DNS lookup. When "UseReverseDNS on" is enabled, the attacker-supplied hostname is passed unescaped into SQL queries. The character restrictions of DNS names may affect exploitability.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated May 6, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
ProFTPDBrowse ProFTPD / ProFTPDDefault status: unaffected | CVE List | Through 1.3.9a | affected |
References
3github.com
https://github.com/proftpd/proftpd/issues/2057 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-44331