The vulnerability originates from the mod_sql component of ProFTPD versions older than 1.3.10rc1. An attacker can supply a specially crafted username in the FTP USER command. When the server logs USER requests using an expansion such as %U, the username value is passed directly to the SQL backend. If that backend accepts SQL commands such as COPY TO PROGRAM, the malicious input triggers execution of arbitrary shell commands on the server. This is a classic SQL injection (CWE‑89) that leads to remote code execution and can compromise confidentiality, integrity, and availability of the affected system.

Vendor and product: ProFTPD, ProFTPD. The vulnerability exists in all releases prior to 1.3.10rc1. Users running the mod_sql module with any SQL backend that permits external command execution and with logging configured to expand the username field are exposed.

The CVSS score of 8.1 indicates a high severity risk. No EPSS score is available, so the current exploration probability is unknown; however, the exploit requires specific configuration conditions (mod_sql enabled, %U logging, and a permissive SQL backend). The vulnerability is not listed in CISA’s KEV catalog, but its remote nature and the straightforward input vector make it an attractive target for attackers. If the conditions are met, an attacker can execute arbitrary commands on the host without needing additional privileges.