ProFTPD CVE-2015-3306: exploited mod_copy flaw, how to mitigate

TL;DR

• What: CVE-2015-3306 is an access control flaw in the mod_copy module of ProFTPD that lets a network client use the site cpfr and site cpto commands to read and write files it should not touch.
• Impact: file reads and writes on the server without credentials, which can lead to code execution on the host.
• Severity: a CVSS v3.1 base score of 10 (critical) in the National Vulnerability Database record, weakness class CWE-284.
• Exploited: yes. CISA added it to the Known Exploited Vulnerabilities catalogue on October 8, 2026, with a remediation due date of October 11, 2026.
• Fix: no fixed version is named in the sources we checked. Use your distribution's security notice and the vendor advisory, or remove mod_copy and restrict access until you can patch.

What CVE-2015-3306 is

ProFTPD is a widely used FTP server for Linux. It is built from modules, and one of them, mod_copy, adds commands that let a client copy files on the server side. CVE-2015-3306 is a flaw in that module: the National Vulnerability Database says an unauthenticated network client can use the site cpfr and site cpto commands to copy and overwrite files anywhere the server process can reach. The first command names the source of a copy, the second names the destination, and the module does not enforce the access controls you would expect on either side.

In plain terms, someone who can reach the FTP port can ask the server to copy a file from one place to another with the privileges of the ProFTPD process. That is enough to read sensitive files, and enough to drop a file into a location that the server or another service will later execute. CISA classes the issue as improper access control, and the weakness is tracked as CWE-284.

The vulnerability was published in the National Vulnerability Database in May 2015 and the record has been reanalysed since. That is why this story is a good reminder that old bugs do not stay old: the catalogue entry that matters today is the exploitation evidence, not the publication date.

Why it matters now

CISA added CVE-2015-3306 to its Known Exploited Vulnerabilities catalogue on October 8, 2026 and set a due date of October 11, 2026 for federal agencies to act. The catalogue only lists flaws with evidence of active exploitation, so a listing is the clearest signal available that attackers are using it against real systems. CISA lists known ransomware campaign use as unknown, which means you should not wait for that to change before acting.

Three things make this one easy to miss. It is an old CVE, so many scanners and spreadsheets already carry it as closed or low priority. FTP servers tend to be installed once and forgotten. And the affected software is a package that many Linux servers and container images include without anyone thinking of it as part of the attack surface. Teams who tracked our earlier coverage of an exploited Brotli decoder flaw will recognise the pattern: the exploited catalogue is where old components come back.

Am I affected?

The National Vulnerability Database lists ProFTPD 1.3.5 as affected, and its configuration data also names several Linux distributions that shipped that version. Because the flaw lives in mod_copy, you are exposed only if the server runs ProFTPD with that module loaded and reachable. Distributions often backport fixes without changing the upstream version number, so the version string alone does not settle the question. Compare the package version against your distribution's security notice.

To check one machine by hand, start with the package manager, then look at the configuration:

dpkg -l 'proftpd*'
rpm -qa 'proftpd*'
apk info -v proftpd
proftpd -v
grep -ri mod_copy /etc/proftpd/ /etc/proftpd.conf 2>/dev/null
ss -ltnp | grep proftpd

The first three commands show the installed package on Debian family, Red Hat family and Alpine systems. The version command shows the upstream version of the binary. The grep shows whether the module is loaded or configured, and the last command shows whether the service is listening on the network. If the package is present but the service is stopped and the module is absent, your exposure is much lower, though you should still plan to remove or update the package.

Remember containers. A base image or an application image may include ProFTPD even when no host package list shows it. Check images as well as hosts.

How to mitigate CVE-2015-3306

No fixed version is named in the sources we checked, so we will not guess one. The authoritative sources are your distribution's security notice and the vendor's own advisory at the ProFTPD project site. Work through these steps in order:

1. Find every ProFTPD installation: hosts, containers and any server that was set up by hand. Record the package version and whether mod_copy is loaded.
2. Read your distribution's security notice for ProFTPD and install the updated package it names. Restart the service and confirm that the new package version is the one running.
3. Where no fixed package exists, or while you wait for one, remove or comment out the mod_copy module in the ProFTPD configuration and restart the service. Only keep it if a workflow truly needs server-side copies.
4. Restrict network access to the FTP service to the addresses that need it, and review logs for the site cpfr and site cpto commands from unknown clients.
5. If you see signs of exploitation, treat the host as compromised: follow CISA's forensics guidance, rotate credentials the server could read, and rebuild from a known good image.
6. If the product cannot be mitigated and you do not need it, stop using it, which is what CISA's required action says to do when mitigations are unavailable.

Our guide to remediation in Stackurity explains how upgrade cards group the fixes for one package.

How to check with Stackurity

Stackurity keeps one live inventory of the software on your servers, repositories and container images. A read-only agent on Linux servers reads installed packages, and packages are assessed on Debian, Ubuntu, Alpine, Rocky Linux, AlmaLinux, Red Hat Enterprise Linux, SUSE Linux Enterprise, openSUSE Leap and Amazon Linux. The inventory is matched against new advisories every hour and against the CISA Known Exploited Vulnerabilities catalogue every day, using each ecosystem's own version rules so that distribution backports are not reported as false alarms. That matters here, because a patched package with an old version number should not raise an alert.

Each finding is ranked from P1 to P4 from exploitation, exposure and environment, and it says in one sentence why it applies. Because this flaw is in the CISA catalogue, a ProFTPD package on a server that is reachable from the network is the kind of finding that rises to the top of the list. After you update, the check again function asks the agent for a fresh report and records whether the issue is passed, partly fixed or still open, so you can prove the fix rather than assume it. The verification guide describes that step.

Be clear about the limits. Stackurity does not assess a copy of ProFTPD compiled by hand or copied into an application outside a package manager, and it does not cover network appliance firmware. Where a runtime was installed outside a package manager, only end of life is checked. If your FTP service lives on an appliance, rely on the vendor's advisory instead. You can try the rest with the 14-day free trial, which needs no card: start a free trial.

FAQ

Is CVE-2015-3306 being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalogue on October 8, 2026, which means the agency has evidence of exploitation in the wild. Whether it has been used in ransomware campaigns is listed by CISA as unknown.

Which ProFTPD version is affected?

The National Vulnerability Database lists ProFTPD 1.3.5 as affected. The flaw is in the mod_copy module, so a server that does not load that module is not exposed to this particular bug.

What is the fixed version of ProFTPD for CVE-2015-3306?

The sources we checked do not name a fixed version. Check your distribution's security notice and the ProFTPD project's advisory for the package version that carries the fix, and do not assume a newer upstream number is enough without reading it.

Does Stackurity find vulnerable ProFTPD servers?

Stackurity's read-only agent on Linux servers reads installed packages and matches them against advisories and the CISA catalogue, so a ProFTPD package from a supported distribution is checked. A copy of ProFTPD built by hand outside a package manager is checked for end of life only, not for this vulnerability.

What should I do if I cannot patch right away?

CISA's required action says to apply mitigations following vendor instructions, or to stop using the product if mitigations are not available. In practice that means disabling mod_copy and limiting who can reach the FTP service until a fixed package is installed.

Sources: CISA Known Exploited Vulnerabilities catalogue, NIST National Vulnerability Database and Stackurity product facts.