{"id":"proftpd-mod-copy-file-access-oct-2026","category":"patch","status":"closed","title":"ProFTPD mod_copy file-access flaw CVE-2015-3306, a 2015 bug, added to CISA's exploited list","tldr":"CISA says attackers are using CVE-2015-3306, a 2015 ProFTPD flaw that lets anyone read and write files via SITE CPFR/CPTO. If you run ProFTPD with mod_copy, update it or disable mod_copy. Home users are unlikely to be affected.","summary":"On 8 October 2026 CISA added CVE-2015-3306 to its list of flaws being used in attacks. The bug is in mod_copy, an optional module of the ProFTPD file-transfer server. CISA describes it as letting remote attackers read and write arbitrary files through the SITE CPFR and SITE CPTO commands, and rates it CVSS 10. Debian's 2015 advisory says the module allowed unauthenticated users to copy files around on the server, which could also allow code to run. The flaw is old: Debian shipped fixed packages in May 2015, so the fix has existed for over a decade. It affects only servers still running an unpatched ProFTPD with mod_copy enabled, typically business or hosting systems and some older NAS or web-hosting setups. The sources HARD read do not say who is attacking, how many servers are hit, or whether other distributions' fixes differ. Attackers are reported to be using it, so any exposed old ProFTPD server should be treated as a priority.","action":"If you run a ProFTPD server, update it to your distribution's current package (Debian fixed versions: 1.3.4a-5+deb7u3, 1.3.5-1.1+deb8u1, 1.3.5-2 or later), or turn off mod_copy. Otherwise, nothing for you to do.","product":"ProFTPD FTP server (mod_copy module)","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2015-3306"],"tags":["proftpd","ftp","mod-copy","cisa-kev","exploited","server","debian"],"affected":["ProFTPD with the mod_copy module (Debian proftpd-dfsg before the fixed versions in wheezy, jessie and 1.3.5-2)"],"fixed":["Debian wheezy: proftpd-dfsg 1.3.4a-5+deb7u3","Debian jessie: proftpd-dfsg 1.3.5-1.1+deb8u1","Debian testing/unstable: proftpd-dfsg 1.3.5-2"],"matches":[],"sources":[{"kind":"advisory","title":"DSA-3263-1 proftpd-dfsg security update","url":"https://lists.debian.org/debian-security-announce/2015/msg00154.html","by":"Debian Security","date":"2015-05-19"},{"kind":"advisory","title":"CISA Known Exploited Vulnerabilities Catalog: CVE-2015-3306","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3306","by":"CISA","date":"2026-10-08"}],"started":"2026-10-08","closed":"2026-10-08","created":"2026-11-03T22:06:14.537Z","updated":"2026-11-03T22:06:14.537Z","cve_notes":[{"cve":"CVE-2015-3306","name":"Unauthenticated file copy in ProFTPD mod_copy","what":"An access-control flaw in ProFTPD's mod_copy module that lets a remote attacker read and write files on the server through the SITE CPFR and SITE CPTO commands, without logging in, and potentially run code.","severity":"critical","cvss":10}],"timeline":[{"at":"2026-10-08","added":"2026-11-03T22:05:25.250Z","kind":"cisa-added","text":"CISA added CVE-2015-3306 to its list of vulnerabilities being used in attacks, with a CVSS score of 10. It describes remote attackers reading and writing arbitrary files through the SITE CPFR and SITE CPTO commands. Which attackers are using it, and against whom, is not stated in the sources HARD read.","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3306","by":"CISA","patch":null},{"at":"2015-05-19","added":"2026-11-03T22:05:25.250Z","kind":"disclosed","text":"Debian published DSA-3263-1 for the ProFTPD server. Vadim Melihow found that its mod_copy module let unauthenticated users copy files around on the server, which could also lead to running code. Fixed Debian packages were released for wheezy, jessie and the testing and unstable branches.","url":"https://lists.debian.org/debian-security-announce/2015/msg00154.html","by":"Debian Security","patch":"patched"}],"url":"https://hard.fyi/live/proftpd-mod-copy-file-access-oct-2026/","json":"https://hard.fyi/api/live?id=proftpd-mod-copy-file-access-oct-2026"}