CVE-2015-3306: ProFTPD mod_copy Vulnerability

What Happened?

CVE-2015-3306 is a ProFTPD vulnerability affecting the mod_copy module in ProFTPD 1.3.5. The module provides server-side file and directory copying through FTP commands: a client selects a source with SITE CPFR, then copies it to a destination with SITE CPTO. The vulnerable implementation did not reliably enforce configured access restrictions for these operations.

Analyst’s Take: Treat an Internet-facing ProFTPD 1.3.5 service with mod_copy enabled as an urgent remediation target. The combination of arbitrary file operations, a CVSS score of 10.0, CISA KEV status, and public exploit material makes patching or disabling the module the first operational step.

The practical impact depends on the ProFTPD process account and filesystem permissions. An attacker may copy sensitive files into an FTP-readable location or place attacker-controlled content in a web root, application directory, cron location, SSH directory, or another writable path.

The vulnerability does not automatically grant unrestricted root access. However, a service account with broad write permissions can turn the flaw into a path to persistence or further compromise.

Who Needs to Act?

The directly affected upstream product is ProFTPD 1.3.5 when mod_copy is available and active. Administrators should identify both the upstream ProFTPD version and the operating-system package revision.

A package may retain an older upstream version string while containing a vendor backport, so version comparison alone is insufficient on Debian, Fedora, Red Hat, openSUSE, and similar distributions.

The supplied research identifies these Debian package versions as fixed:

Fedora 20, Fedora 21, and Fedora 22 package configurations were identified as affected in NVD-related results. The available research does not provide a complete fixed-package table for Fedora, Red Hat, or openSUSE. Those systems should be updated through the applicable security channel and verified against the distribution advisory or package changelog rather than by adopting a Debian package number.

Systems that load mod_copy, permit FTP access from untrusted networks, or expose FTP directly to the Internet should receive priority. Internal FTP servers also belong in the review because attackers may reach them after compromising a workstation, VPN account, web application, or adjacent server.

For background on access-control terminology, see our glossary guide on what “right to be forgotten” means.

Why Is the CVSS Score 10.0?

NVD assigns CVE-2015-3306 a base score of 10.0, the maximum severity. The score reflects the combination of remote reachability and the ability to affect confidentiality and integrity through arbitrary file operations.

Reading sensitive files can expose credentials, application secrets, private keys, and configuration data. Writing files can enable web-shell placement, configuration tampering, persistence, or subsequent code execution where the target path is interpreted by another service.

The supplied NVD result does not include the authoritative CVSS vector string, so the exact component values should be verified directly in the NVD record before reproducing the score in a risk system. The available evidence supports a network-reachable attack path and high confidentiality and integrity consequences.

Availability impact should not be assumed for every deployment. An attacker’s ability to affect availability depends on which files the ProFTPD process can overwrite or copy.

CVSS is a severity measure, not a prediction of whether a particular host is compromised. Here, exploitation evidence increases operational urgency: CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2026-10-08, with a remediation deadline of 2026-10-11. That deadline has passed as of this article’s publication date.

Has CVE-2015-3306 Been Exploited?

Yes. CISA lists CVE-2015-3306 in the Known Exploited Vulnerabilities catalog, confirming exploitation in the wild. The catalog identifies the issue as a ProFTPD improper access-control vulnerability. CISA’s ransomware-use field is Unknown; KEV inclusion does not establish that ransomware operators specifically used this vulnerability.

Yes, public exploit-related material exists. The NVD references a Packet Storm item titled “ProFTPd 1.3.5 File Copy.” The material is associated with abusing the vulnerable file-copy functionality.

Defenders should assume that exploitation knowledge is available to attackers and that opportunistic scanning may target Internet-facing ProFTPD services.

The available research does not establish which organizations were targeted, which campaigns used the flaw, or whether a particular host was compromised. Treat KEV status as a reason to perform retrospective investigation, not as proof that every vulnerable server was exploited.

How Do I Know If a Server Is Affected?

Start by inventorying ProFTPD installations, listening addresses, loaded modules, package revisions, and historical exposure. Confirm whether mod_copy is loaded and whether FTP clients can issue SITE CPFR or SITE CPTO.

Review both ProFTPD authentication logs and operating-system audit data because successful file copies may not be obvious from FTP session logs alone.

Search for the command names and suspicious source or destination paths. Log formats differ, so preserve original logs first and test queries against a representative sample.

Technical Detection Notes

A basic Linux search for common ProFTPD command-logging patterns is:

sudo zgrep -Ei 'SITE[[:space:]]+(CPFR|CPTO)|\bCPFR\b|\bCPTO\b' \\
  /var/log/proftpd/*.log /var/log/proftpd/*.log.* 2>/dev/null

For text-based SIEM ingestion, a detection query can flag the commands and high-risk destinations:

product="proftpd"
| where upper(message) matches regex "SITE[[:space:]]+(CPFR|CPTO)"
| where message matches regex "(etc/passwd|etc/shadow|\.ssh/|authorized_keys|cron|www/|public_html|\.php)"

The exact field names must be adapted to the organization’s SIEM. Useful network telemetry includes FTP commands containing SITE CPFR or SITE CPTO, especially when followed by an unusual destination, repeated failures, or a session from an unfamiliar source address.

Examine filesystem activity around the FTP service account as well. Look for:

• Newly created PHP, CGI, shell, JavaScript, or configuration files in web roots
• Changes to authorized_keys, cron directories, service configuration, and application secrets
• Reads of sensitive files followed by writes elsewhere
• Unexpected files owned by the ProFTPD service account
• File activity occurring shortly after suspicious FTP sessions

If Linux auditd is enabled, filter events by the ProFTPD process or service account and correlate file opens, creates, and renames with FTP session timestamps.

How Do I Fix CVE-2015-3306?

Apply the security update for the operating-system distribution or vendor package. The fixed Debian package versions identified in the available research are:

• 1.3.4a-5+deb7u3 for wheezy
• 1.3.5-1.1+deb8u1 for jessie
• 1.3.5-2 for stretch and sid

These are package-specific fixes, not a universal upstream version rule.

For Debian-based systems where those repositories remain available, an upgrade command is:

sudo apt-get update
sudo apt-get install --only-upgrade proftpd-basic proftpd-core proftpd-dfsg
sudo systemctl restart proftpd

Package names vary by release and installation method. Verify the installed result with dpkg-query and confirm that the distribution changelog or advisory identifies the CVE fix:

dpkg-query -W -f='${Package} ${Version}\n' 'proftpd*'
apt-cache policy proftpd-basic proftpd-core proftpd-dfsg

Disable mod_copy if Patching Is Delayed

If patching cannot be completed immediately, disable or unload mod_copy, provided the service does not require it. Locate the module-load directive first:

sudo grep -RInE '^[[:space:]]*LoadModule[[:space:]]+mod_copy' \\
  /etc/proftpd /etc/proftpd.conf 2>/dev/null

Comment out the matching LoadModule line according to the local configuration layout, validate the configuration, and restart ProFTPD:

sudo proftpd -t
sudo systemctl restart proftpd

The exact module directive and package layout can differ. After restarting, verify that SITE CPFR and SITE CPTO are unavailable or correctly restricted.

If mod_copy is required, apply the vendor patch and ensure the relevant <Limit> rules are enforced. Do not rely on an untested configuration workaround.

Reduce Exposure

Restrict FTP exposure to trusted networks, disable anonymous access unless explicitly required, and enforce least privilege for the ProFTPD service account.

For administrators who must reach FTP infrastructure remotely, place the service behind a properly managed corporate VPN or private access gateway rather than exposing it directly to the Internet. A consumer VPN service such as Check NordVPN pricing → is not a substitute for enterprise access controls, network segmentation, patching, or incident response.

Preserve logs and investigate pre-patch activity before deleting suspicious files or rebuilding the server. If arbitrary writes occurred in a web root or executable directory, treat the host as potentially compromised and follow incident-response procedures.

The first action is to identify exposed ProFTPD 1.3.5 systems with mod_copy active, then patch them or disable the module. Once exposure is contained, use FTP and filesystem telemetry to determine whether file reads or writes occurred before remediation.

Related Security Guidance

Organizations investigating a potentially compromised server should also review recent vulnerability activity and remediation priorities in the October 15 Pan-OS and Cisco zero-day digest.

When investigating affected endpoints or servers, use approved enterprise security tooling and preserve evidence before running cleanup utilities. Malwarebytes may be useful as part of an authorized endpoint investigation through Malwarebytes website, but scanning does not replace forensic analysis or patch verification.