cyfenced.com →

[ CVE-2015-3306 · Published 18 May 2015 ]

ProFTPD mod_copy lets anyone copy files on the server

Exploited · CISA KEV CVSS 10.0 EPSS 99%No fix listed yet

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2026-10-08
  • EPSS: 99% chance of exploitation in the next 30 days (higher than 100% of CVEs)
  • Critical severity: CVSS 10.0

[ Analyst view ]Is this a red alert for you?

Red alert

CISA lists it as exploited, and the commands work without logging in.

Red alert if
You run ProFTPD 1.3.5 with mod_copy enabled and it is reachable from the internet.
Can wait if
You do not run ProFTPD, or run a later version without this flaw.
What it is
The mod_copy module in ProFTPD 1.3.5 lets remote attackers read and write arbitrary files using the SITE CPFR and SITE CPTO commands, without logging in. The flaw dates from 2015 but CISA added it to its exploited list in October 2026.
Impact
An attacker can copy files anywhere the FTP service can write, with no credentials. On servers that also host a website, this is a well-known path to placing a script in the web directory and taking over the server.

How an attack would work MITRE ATT&CK

  1. T1190 Exploit Public-Facing ApplicationThe attacker connects to the internet-facing FTP service and uses the copy commands.
  2. T1005 Data from Local SystemThey copy sensitive files to a place where they can read them.
  3. T1505.003 Server Software Component: Web ShellThey copy a script into the web root to get a web shell.
  4. T1059 Command and Scripting InterpreterThe web shell runs commands on the server.

What to do

  1. Upgrade ProFTPD to a current release from your Linux distribution or proftpd.org.
  2. If you cannot upgrade, disable the mod_copy module.
  3. Check the web root and other writable directories for files you do not recognise.
  4. Consider whether the FTP service needs to be reachable from the internet at all.
Written with AI from the sources on this page on 23 Oct 2026. Check the vendor's advisory before you act.

[ Description ]Official description

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

CISA: ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 11 Oct 2026): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References