ProFTPD, CVE-2015-3306: on CISA's exploited list

The bottom line

If you run ProFTPD with the mod_copy module, treat this as overdue: CISA's date of 11 October 2026 has passed. First find out whether ProFTPD runs anywhere on your estate; if it does not, you can stop reading.

Free analysis report · 9 pagesProFTPD, CVE-2015-3306: on CISA's exploited listThe same note as a document you can keep or forward: what the sources say, who is affected, and what to do first.Download the analysis report →

At a glance

Does this apply to you?

What it is

The record says a remote attacker can read and write arbitrary files using the site cpfr and site cpto commands of the mod_copy module. Debian's advisory says no login is needed and that running code is possible.

Why it matters

Our reading is that this flaw gives an attacker file access without a login, which makes it useful for stealing data, changing files or planting something on the server. The record scores it 10 on CVSS 3.1. The weakness is CWE-284 Improper Access Control. The advisory dates from 2015, so old, unmaintained FTP servers are the likely place for it to remain.

What the vendor's advisory says

We read one page on lists.debian.org. In short:

• Debian's advisory DSA-3263-1 of 19 May 2015 says mod_copy let unauthenticated users copy files around on the server, and possibly execute arbitrary code.
• The advisory names fixes for three Debian releases: 1.3.4a-5+deb7u3 for wheezy, 1.3.5-1.1+deb8u1 for jessie, and 1.3.5-2 for stretch and sid.
• The advisory recommends upgrading your proftpd-dfsg packages. It names no workaround.

Exposure by situation

These priorities are our judgement from what the sources say about who can use the flaw and how. They are not vendor ratings.

Things people will get wrong

• "We only use FTP for harmless files." The record says an attacker can read and write arbitrary files, not only the FTP area. Debian says running code is possible.
• "It needs a valid account." Debian's advisory says unauthenticated users could use the copy commands.
• "A 2015 flaw must be patched already." CISA lists it as exploited. Old servers that are never updated stay exposed.

How we would triage it

This is our judgement.

The commands only read: they print a version or list what is installed. They come from general knowledge of this kind of product, not from the sources, so check them against the vendor's page before you run them. Words in capitals are for you to fill in.

Step 1: Find where ProFTPD runs

• List every server, appliance and hosting account that offers FTP. Ask your provider if unsure.
• Check the installed version and whether mod_copy is loaded.

proftpd -v

Step 2: Reduce exposure

• Limit access to the FTP service to known addresses until it is patched.
• Switch mod_copy off if you do not use it. The record's attack depends on this module.

Step 3: Patch

• Install the Debian package version listed for your release, or a newer one.
• If you use another distribution, ask its vendor for the fixed version. No source here names one.

Step 4: Check for signs of misuse

• Review FTP logs for site cpfr and site cpto commands you cannot explain.
• Check for files changed or added that nobody on your side made.

To close it, read the version from the product itself, not from an old inventory, and save the output with the date. If you cannot update today, write down who owns it, the new date, and what limits exposure until then.

Send this to your IT provider

Copy it, change the names and dates, and send it. It is a draft for you to check, not a template tested with any provider.

Hello, we need to know whether we run ProFTPD (CVE-2015-3306, the mod_copy flaw) and where. Please tell us each server that runs it, the exact version, and whether mod_copy is loaded. Debian's advisory lists fixes: 1.3.4a-5+deb7u3 (wheezy), 1.3.5-1.1+deb8u1 (jessie) and 1.3.5-2 (stretch, sid). CISA's date of 11 October 2026 has passed, so please treat this as urgent. Please confirm the version and the fix to us in writing by the end of this week.

Signs it was used

An update closes the hole. It does not tell you whether someone used it first. CISA's required action points to its forensic triage requirements (BOD 26-04). Look for:

• FTP log entries showing site cpfr or site cpto commands, especially from addresses you do not recognise.
• Files in unexpected places, or changed recently, that the FTP service account could write to.

The weakness behind it

CISA's entry classes this as CWE-284 (Improper Access Control).

The sources, in their words

CISA's catalogue entry:

ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

The CVE record, published by Mitre on 18 May 2015:

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

The record gives no version ranges. Use the vendor's advisory for the affected versions.

CISA's required action:

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes).

What we do not know yet

• Which upstream ProFTPD release fixes this; the sources here name only Debian package versions.
• Whether versions other than 1.3.5 are affected; the record lists no version ranges.
• Which systems CISA saw attacked, or how.
• We have not tested this against any environment. Versions and scores are as the sources state them and as at 1 November 2026; the vendor's advisory wins where it differs.
• The sections headed "The bottom line", "Does this apply to you?", "What it is", "Why it matters", "Exposure by situation", "Things people will get wrong", "How we would triage it" and "Send this to your IT provider" are our interpretation of the sources, not a statement by CISA or the vendor.

• Today's mission →Every exploited vulnerability from the last seven days, in the order their deadlines fall.
• The CVE Triage Handbook →How to check, analyse and triage a CVE. Free with registration.