ProFTPD mod_copy file-access flaw CVE-2015-3306, a 2015 bug, added to CISA's exploited list
CISA says attackers are using CVE-2015-3306, a 2015 ProFTPD flaw that lets anyone read and write files via SITE CPFR/CPTO. If you run ProFTPD with mod_copy, update it or disable mod_copy. Home users are unlikely to be affected.
If you run a ProFTPD server, update it to your distribution's current package (Debian fixed versions: 1.3.4a-5+deb7u3, 1.3.5-1.1+deb8u1, 1.3.5-2 or later), or turn off mod_copy. Otherwise, nothing for you to do.
What’s happening
On 8 October 2026 CISA added CVE-2015-3306 to its list of flaws being used in attacks. The bug is in mod_copy, an optional module of the ProFTPD file-transfer server. CISA describes it as letting remote attackers read and write arbitrary files through the SITE CPFR and SITE CPTO commands, and rates it CVSS 10. Debian's 2015 advisory says the module allowed unauthenticated users to copy files around on the server, which could also allow code to run. The flaw is old: Debian shipped fixed packages in May 2015, so the fix has existed for over a decade. It affects only servers still running an unpatched ProFTPD with mod_copy enabled, typically business or hosting systems and some older NAS or web-hosting setups. The sources HARD read do not say who is attacking, how many servers are hit, or whether other distributions' fixes differ. Attackers are reported to be using it, so any exposed old ProFTPD server should be treated as a priority.
- What
- Flaw
- Affects
- ProFTPD FTP server (mod_copy module)
- Affected
- ProFTPD with the mod_copy module (Debian proftpd-dfsg before the fixed versions in wheezy, jessie and 1.3.5-2)
- Fixed in
- Debian wheezy: proftpd-dfsg 1.3.4a-5+deb7u3
Debian jessie: proftpd-dfsg 1.3.5-1.1+deb8u1
Debian testing/unstable: proftpd-dfsg 1.3.5-2 - Since
- 8 Oct 2026
- Closed
- 8 Oct 2026
Timeline
- CISA added
CISA added CVE-2015-3306 to its list of vulnerabilities being used in attacks, with a CVSS score of 10. It describes remote attackers reading and writing arbitrary files through the SITE CPFR and SITE CPTO commands. Which attackers are using it, and against whom, is not stated in the sources HARD read.
- Made publicFixed
Debian published DSA-3263-1 for the ProFTPD server. Vadim Melihow found that its mod_copy module let unauthenticated users copy files around on the server, which could also lead to running code. Fixed Debian packages were released for wheezy, jessie and the testing and unstable branches.
Sources
- DSA-3263-1 proftpd-dfsg security updateDebian Security · 19 May 2015
- CISA Known Exploited Vulnerabilities Catalog: CVE-2015-3306CISA · 8 Oct 2026