CVE-2015-3306 The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
HighCVSS 10.0
EPSS 99.5%
CISA KEV
added 2026-10-08 · due 2026-10-11
Exploited in the wild
Framework module
Public exploit
PoC
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
CISA Known Exploited Vulnerability
- Date added
- 2026-10-08
- Due date (FCEB)
- 2026-10-11
- Ransomware use
- Unknown
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/proftpd-dfsg(Debian:12) | < 1.3.5-2 | 1.3.5-2 |
| debian/proftpd-dfsg(Debian:13) | < 1.3.5-2 | 1.3.5-2 |
| debian/proftpd-dfsg(Debian:14) | < 1.3.5-2 | 1.3.5-2 |
| fedoraproject fedora | = 20 | No fix listed |
| fedoraproject fedora | = 21 | No fix listed |
| fedoraproject fedora | = 22 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| openSUSE Tumbleweed | All versions | No fix listed |
| SUSE linux enterprise server | = 15-sp7 | No fix listed |
| proftpd | = 1.3.5 | No fix listed |
References
- Debian Security Tracker CVE-2015-3306 vendor-advisory
- bugs.debian.org issue-tracking
- www.rapid7.com third-party-advisory
- 36803 exploit
- packetstormsecurity.com third-party-advisory vdb-entry
- DSA-3263 mailing-list third-party-advisory vendor-advisory
- packetstormsecurity.com exploit vdb-entry
- packetstormsecurity.com exploit vdb-entry
- openSUSE-SU-2015:1031 mailing-list third-party-advisory vendor-advisory
- FEDORA-2015-7164 broken-link mailing-list third-party-advisory vendor-advisory
- FEDORA-2015-6401 broken-link mailing-list third-party-advisory vendor-advisory
- 74238 third-party-advisory vdb-entry
- 36742 exploit
- FEDORA-2015-7086 broken-link mailing-list third-party-advisory vendor-advisory
- packetstormsecurity.com third-party-advisory vdb-entry
- packetstormsecurity.com exploit vdb-entry
- www.cisa.gov government-resource us-government-resource