ProFTPD vulnerabilities
We track 6 vulnerabilities in ProFTPD products. 6 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on July 20, 2026.
Latest ProFTPD vulnerabilities
- 8.8 High severity
proftpd: Heap-based Buffer Overflow
ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp module that allows authenticated low-privilege attackers to achieve arbitrary code execution by sending crafted SFTP packet fragments exceeding the 16 KB re
- 8.1 High severity
ProFTPD: Improper Neutralization of Special Elements used in an SQL Command
In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltab_fetch_clients_cb() in contrib/mod_wrap2_sql.c allows a remote attacker to inject arbitrary SQL commands via a crafted domain name that is accessed in a reverse DNS lookup. When "
- 8.1 High severity
ProFTPD: Improper Neutralization of Special Elements used in an SQL Command
mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).
- 7.5 High severity
proftpd: Incorrect Authorization
In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access to GID 0 because of the lack of supplemental groups from mod_sql.
- 7.5 High severity
Proftpd: Out-of-bounds Read
make_ftp_cmd in main.c in ProFTPD before 1.3.8a has a one-byte out-of-bounds read, and daemon crash, because of mishandling of quote/backslash semantics.
- 10.0 High severity
ProFTPD Improper Access Control Exploited
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.