---
id: "CVE-2015-3306"
kind: "vulnerability"
aliases: ["CVE-2015-3306"]
title: "The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr\u2026"
severity: "critical"
cvss: 10.0
epss: null
exploited: true
status: "open"
category: "runtime"
products: [{"name": "ProFTPD ProFTPD", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "fedoraproject fedora", "fixed": [], "affected": "= 20", "ecosystem": "vendor"}, {"name": "fedoraproject fedora", "fixed": [], "affected": "= 21", "ecosystem": "vendor"}, {"name": "fedoraproject fedora", "fixed": [], "affected": "= 22", "ecosystem": "vendor"}, {"name": "debian linux", "fixed": [], "affected": "= 7.0", "ecosystem": "vendor"}, {"name": "debian linux", "fixed": [], "affected": "= 8.0", "ecosystem": "vendor"}, {"name": "debian linux", "fixed": [], "affected": "= 9.0", "ecosystem": "vendor"}, {"name": "opensuse tumbleweed", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "suse linux enterprise server", "fixed": [], "affected": "= 15", "ecosystem": "vendor"}, {"name": "proftpd", "fixed": [], "affected": "= 1.3.5", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "ftp", "proftpd", "runtime", "self-hosted"]
not_affected_if: ["default-config"]
published_at: "2015-05-18T15:59:10+00:00"
first_seen_at: "2026-10-23T19:11:50+00:00"
updated_at: "2026-10-23T23:44:52+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-3306", "first_seen_at": "2026-10-23T19:11:50+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3306", "first_seen_at": "2026-10-23T23:44:52+00:00"}]
---

# The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr…

ProFTPD's mod_copy module accepts the SITE CPFR and SITE CPTO commands without proper access control, so a remote unauthenticated client can copy and overwrite files anywhere the server process can reach. Attackers can use this to read sensitive files and plant content such as web shells or altered configuration.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:ProFTPD ProFTPD affected ? fixed ?
- vendor:fedoraproject fedora affected = 20 fixed ?
- vendor:fedoraproject fedora affected = 21 fixed ?
- vendor:fedoraproject fedora affected = 22 fixed ?
- vendor:debian linux affected = 7.0 fixed ?
- vendor:debian linux affected = 8.0 fixed ?
- vendor:debian linux affected = 9.0 fixed ?
- vendor:opensuse tumbleweed affected ? fixed ?
- vendor:suse linux enterprise server affected = 15 fixed ?
- vendor:proftpd affected = 1.3.5 fixed ?

## How to check

Check whether mod_copy is loaded: run 'proftpd -V' or look for 'mod_copy' in the ProFTPD configuration (LoadModule or compiled-in modules); the sources do not give a specific command beyond this.
Test from a host outside your network only with authorization: send 'SITE CPFR' to the FTP port and see whether the server responds with a 350 status.

## Fix

Disable or remove mod_copy (for example, comment out its LoadModule line or restrict SITE commands), and restrict FTP access to trusted networks until patched. Upgrade ProFTPD to a fixed release from the vendor; the exact fixed version is unknown from these sources.

## Timeline

- 2026-10-23T19:11:50+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-3306
- 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2015-3306

## From the sources

ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_