{"id":"CVE-2015-3306","kind":"vulnerability","aliases":["CVE-2015-3306"],"related":[],"title":"The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr…","description":"ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"ProFTPD's mod_copy module accepts the SITE CPFR and SITE CPTO commands without proper access control, so a remote unauthenticated client can copy and overwrite files anywhere the server process can reach. Attackers can use this to read sensitive files and plant content such as web shells or altered configuration.","severity":"critical","cvss":10.0,"epss":null,"exploited":true,"exploited_at":"2026-10-08T00:00:00+00:00","products":[{"name":"ProFTPD ProFTPD","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 20","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 21","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 22","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 7.0","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 8.0","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 9.0","ecosystem":"vendor"},{"name":"opensuse tumbleweed","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"suse linux enterprise server","fixed":[],"affected":"= 15","ecosystem":"vendor"},{"name":"proftpd","fixed":[],"affected":"= 1.3.5","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","ftp","proftpd","runtime","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"Check whether mod_copy is loaded: run 'proftpd -V' or look for 'mod_copy' in the ProFTPD configuration (LoadModule or compiled-in modules); the sources do not give a specific command beyond this.\nTest from a host outside your network only with authorization: send 'SITE CPFR' to the FTP port and see whether the server responds with a 350 status.","fix":"Disable or remove mod_copy (for example, comment out its LoadModule line or restrict SITE commands), and restrict FTP access to trusted networks until patched. Upgrade ProFTPD to a fixed release from the vendor; the exact fixed version is unknown from these sources.","status":"open","published_at":"2015-05-18T15:59:10+00:00","first_seen_at":"2026-10-23T19:11:50+00:00","triaged_at":"2026-10-23T19:50:05+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-23T19:50:05Z","model":"claude-haiku-5-5","output":{"fix":"Disable or remove mod_copy (for example, comment out its LoadModule line or restrict SITE commands), and restrict FTP access to trusted networks until patched. Upgrade ProFTPD to a fixed release from the vendor; the exact fixed version is unknown from these sources.","summary":"ProFTPD's mod_copy module accepts the SITE CPFR and SITE CPTO commands without proper access control, so a remote unauthenticated client can copy and overwrite files anywhere the server process can reach. Attackers can use this to read sensitive files and plant content such as web shells or altered configuration.","category":"runtime","who_cares":["proftpd","self-hosted","ftp"],"confidence":0.6,"analyst_note":"Confirm the affected and fixed ProFTPD versions and the mod_copy default state from the ProFTPD vendor advisory or NVD entry for CVE-2015-3306.","how_to_check":"Check whether mod_copy is loaded: run 'proftpd -V' or look for 'mod_copy' in the ProFTPD configuration (LoadModule or compiled-in modules); the sources do not give a specific command beyond this.\nTest from a host outside your network only with authorization: send 'SITE CPFR' to the FTP port and see whether the server responds with a 350 status.\nunknown for the exact affected version range.","needs_analyst":true,"not_affected_if":["default-config"],"severity_if_unknown":"high"},"cost_usd":0.000468,"input_tokens":2197,"output_tokens":496,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-04':151C,177C,208C '-2015':23A,26A '-3306':24A,27A '1.3.5':7A '26':150C,176C,207C 'accept':61B 'access':71B,111C 'accord':140C 'action':136C 'adher':204C 'allow':8A,116C 'alter':105B 'anywher':83B 'appli':137C 'applic':174C 'arbitrari':16A,124C 'asset':198C 'attack':10A,89B,118C 'base':155C 'bod':149C,175C,206C 'cisa':134C,147C,164C 'client':77B 'cloud':180C 'command':68B,133C 'complianc':145C 'configur':106B 'contain':108C 'content':99B 'control':72B,112C 'copi':3A,59B,79B 'could':115C 'cpfr':21A,64B,129C 'cpto':67B,132C 'cve':22A,25A 'debian':36A,38A,40A 'discontinu':183C 'ensur':144C,203C 'enterprise':46A 'evalu':196C 'exploit':49B 'exposur':201C 'fedora':31A,33A,35A 'fedoraproject':30A,32A,34A 'file':17A,82B,96B,125C 'follow':173C 'forens':166C 'ftp':50B 'guidanc':162C,178C 'guidelin':210C 'host':55B 'improp':110C 'instruct':143C 'internet':200C 'linux':37A,39A,41A,45A 'mitig':138C,189C 'mod':2A,58B 'modul':4A,60B 'note':161C,172C 'opensuse':42A 'overwrit':81B 'patch':209C 'plant':98B 'priorit':152C 'process':86B 'product':187C 'proftpd':6A,28A,29A,48A,51B,56B,107C 'proper':70B 'reach':88B 'read':12A,94B,120C 'remot':9A,75B,117C 'requir':135C,168C 'respons':194C 'risk':157C 'runtim':52B 'secur':153C 'see':158C,169C 'self':54B 'self-host':53B 'sensit':95B 'server':47A,85B 'servic':181C 'shell':103B 'site':20A,63B,66B,128C,131C 'stakehold':192C 'suse':44A 'triag':167C 'tumbleweed':43A 'unauthent':76B 'unavail':191C 'updat':154C 'url':159C,170C 'use':91B,184C 'vendor':142C 'via':18A,126C 'vulner':113C 'web':102B 'without':69B 'write':14A,122C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2015-05-18T15:59:10+00:00","kev":{"dateAdded":"2026-10-08","dueDate":"2026-10-11","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2015-3306","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-3306","severity":null,"published_at":"2026-10-08T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:50+00:00","fetched_at":"2026-10-25T17:39:54+00:00","note":null},{"source":"nvd","external_id":"CVE-2015-3306","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3306","severity":null,"published_at":"2015-05-18T15:59:10+00:00","modified_at":"2026-10-09T16:17:18+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}