CVE-2026-44331: 
ProFTPd vulnerability analysis and mitigation

CVE-2026-44331 is a SQL injection vulnerability in ProFTPD's mod_wrap2_sql module, specifically in the sqltab_fetch_clients_cb() function within contrib/mod_wrap2_sql.c. It affects ProFTPD through version 1.3.9a prior to commit 7666224, and is only exploitable when the UseReverseDNS on configuration directive is active. The vulnerability was disclosed on May 5, 2026, and carries a CVSS v3.1 base score of 8.1 (High) (Github Advisory, Red Hat Bugzilla).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), arising because the sqltab_fetch_clients_cb() function passes the name parameter — derived from a reverse DNS lookup of the connecting client's IP — directly to sql_cmd_create() without first calling sql_escapestring() (ProFTPD Issue #2057). This contrasts with other ProFTPD SQL modules such as mod_quotatab_sql.c and mod_sftp_sql.c, which correctly escape user-controlled values before SQL operations. An attacker who controls their reverse DNS record (e.g., by operating their own authoritative DNS server) can craft a hostname containing SQL metacharacters that are then injected unescaped into the SQL query executed by ProFTPD. The character restrictions inherent to valid DNS names (e.g., limited to alphanumerics, hyphens, and dots) may constrain but do not fully prevent exploitation (ProFTPD Commit 7666224).

Successful exploitation allows a remote, unauthenticated attacker to inject arbitrary SQL commands into the database used by ProFTPD's mod_wrap2_sql access control module. This can result in authentication bypass (e.g., making ACL WHERE clauses always true), unauthorized data extraction via UNION-based injection, data manipulation, and potential database service disruption — covering high impacts to confidentiality, integrity, and availability (ProFTPD Issue #2057, Github Advisory). Depending on database permissions and configuration, exploitation could also enable command execution at the database level, potentially facilitating lateral movement within the hosting environment (Feedly).

As of the disclosure date, there is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.027–0.038%, placing it in the 12th percentile for exploitation likelihood within 30 days (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to control their reverse DNS hostname and the target server to have UseReverseDNS on enabled alongside the mod_wrap2_sql module, which raises the effective attack complexity.

1. Reconnaissance: Identify internet-facing ProFTPD servers running version 1.3.9a or earlier with mod_wrap2_sql loaded. Banner grabbing via FTP connection or Shodan/Censys queries can reveal ProFTPD version strings.
2. Precondition verification: Confirm that the target ProFTPD instance has UseReverseDNS on configured in proftpd.conf, which causes the server to perform reverse DNS lookups on connecting clients.
3. Control reverse DNS: Set up an authoritative DNS server for an IP block you control, and configure a PTR record for your attacking IP to resolve to a crafted hostname containing SQL injection payloads. DNS name character restrictions (alphanumerics, hyphens, dots) limit but do not eliminate payload options — for example, a hostname like x-OR-1-1.evil.com may be adapted to bypass WHERE clause checks.
4. Initiate FTP connection: Connect to the target ProFTPD server from the IP whose PTR record contains the malicious hostname. ProFTPD performs a reverse DNS lookup and passes the attacker-controlled hostname unescaped into the SQL query in sqltab_fetch_clients_cb().
5. SQL injection execution: The injected SQL payload (e.g., an auth bypass or UNION-based data extraction) executes against the backend database, potentially returning all ACL entries, exposing sensitive data, or manipulating access control records (ProFTPD Issue #2057).

• Network: Unusual or repeated FTP connection attempts from IP addresses whose PTR records contain atypical characters (hyphens in unusual positions, numeric-heavy subdomains) or SQL-like patterns; outbound DNS PTR queries from the ProFTPD server to unexpected or newly registered DNS zones.
• Logs: ProFTPD logs (/var/log/proftpd/proftpd.log) showing reverse DNS hostnames with SQL metacharacters or anomalous formatting; SQL error messages or unexpected query results in the database's query log correlated with FTP connection events.
• Database: Unexpected query patterns in the SQL backend (e.g., UNION SELECT statements, always-true WHERE conditions like OR 1=1) originating from the ProFTPD service account; unauthorized reads from tables unrelated to FTP access control.

The fix was committed to the ProFTPD repository as commit 7666224, which introduces a new sqltab_get_escaped_text() helper function that properly escapes the DNS-derived hostname via sql_escapestr before it is used in SQL queries; users should update to a version of ProFTPD that includes this commit (ProFTPD Commit 7666224). The milestone for the official patched release is ProFTPD 1.3.10 (ProFTPD Issue #2057). As an immediate workaround, administrators should set UseReverseDNS off in proftpd.conf if reverse DNS lookups are not operationally required, which eliminates the attack vector entirely. Additionally, restricting network access to the ProFTPD service to trusted IP ranges and applying database-level least-privilege controls on the ProFTPD SQL user can reduce the blast radius of any exploitation.

The vulnerability received brief coverage on social media platforms including Bluesky and Mastodon via The Hacker Wire shortly after disclosure on May 5, 2026. Red Hat opened a Bugzilla tracking entry (Bug 2466878) and assigned it high severity/priority, indicating it is being tracked for potential impact on Red Hat-distributed packages (Red Hat Bugzilla). A German-language security news outlet (pro-linux.de) also covered the vulnerability, and Fedora package update trackers noted it alongside other security updates.