CVE-2015-3306 (CVSS 10): ProFTPD mod_copy Arbitrary File Read/Write — Now in CISA KEV

What Is CVE-2015-3306?

CVE-2015-3306 is an Improper Access Control vulnerability (CWE-284) in the mod_copy module bundled with ProFTPD 1.3.5. The module exposes two site-extension commands — SITE CPFR (copy from) and SITE CPTO (copy to) — that are intended to let authenticated users duplicate files server-side without a full download/upload cycle.

The flaw is that mod_copy does not enforce proper access controls before processing these commands. A remote attacker who has not authenticated can issue SITE CPFR and SITE CPTO to copy any file readable or writable by the FTP daemon's operating-system user to or from any location on the filesystem. This means sensitive files — configuration files, SSH keys, web application content, database files — can be read, overwritten, or planted without supplying valid credentials.

The vulnerability was published on 18 May 2015 and carries the maximum possible CVSS v3.1 base score of 10.0 (Critical), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Every component of that vector is at its worst: network-reachable, low complexity, no privileges needed, no user interaction, and full compromise of confidentiality, integrity, and availability across a changed scope.

Who and What Is Affected?

According to the NVD advisory, the affected product is ProFTPD 1.3.5 with the mod_copy module active. ProFTPD is a widely deployed open-source FTP server used across Linux, BSD, and Unix-like operating systems, appearing in many hosting control panels, embedded appliances, and self-managed server environments.

• Internet-exposed FTP servers running ProFTPD 1.3.5 are the primary risk surface. Because no authentication is required, any server reachable on port 21 (or a configured alternative) is potentially exploitable.
• Shared hosting environments where ProFTPD is the default FTP daemon are at heightened risk because a single exploitable instance can expose files belonging to many hosted accounts.
• Appliances and embedded systems that ship ProFTPD 1.3.5 and may not receive routine OS-level patches are a persistent concern.
• Organizations that disabled anonymous FTP but left mod_copy loaded may still be vulnerable, as the access control failure is not gated on anonymous access alone.

If you are uncertain whether mod_copy is loaded, inspect your ProFTPD configuration files (commonly /etc/proftpd/proftpd.conf or /etc/proftpd.conf) for LoadModule mod_copy.c or equivalent directives.

Understanding the Impact

The CVSS scope indicator of Changed (C) reflects that successful exploitation can affect resources beyond the FTP service itself — for example, web root directories, cron scripts, or SSH authorized-keys files that reside on the same filesystem. The practical consequences include:

• Confidentiality: Attackers can read any file accessible to the FTP daemon process — potentially including private keys, password hashes, application secrets, and customer data.
• Integrity: Attackers can overwrite or plant files. This is frequently used to drop attacker-controlled content into web-accessible directories, enabling secondary exploitation of web application users.
• Availability: Overwriting critical system or application files can render services inoperable.

CISA's KEV entry confirms that this vulnerability is being actively exploited in the wild. It was added to the CISA Known Exploited Vulnerabilities catalog on 8 October 2026, more than a decade after initial disclosure — a pattern that underscores how long unpatched legacy services remain operational and attractive to attackers.

CISA's required action references BOD 26-04 (Prioritizing Security Updates Based on Risk) and specifies forensic triage requirements, indicating that exploitation may have already impacted federal and critical infrastructure environments. Organizations should treat any system running the affected version as potentially compromised until verified otherwise.

What to Do Right Now

CISA's required action under BOD 26-04 is clear: apply mitigations per vendor instructions, follow BOD 26-04 patching guidelines based on internet exposure, or discontinue use of the product if mitigations are unavailable. The following defensive steps are aligned with that guidance:

1. Inventory immediately. Identify all ProFTPD instances in your environment, including those in hosted, cloud, and embedded contexts. Confirm version numbers and loaded modules.
2. Apply vendor mitigations. Consult the ProFTPD project's official advisories and release notes for patched versions that address CVE-2015-3306. Upgrade to a version that resolves the mod_copy access control flaw.
3. Disable mod_copy if patching is not immediately possible. If a patched version cannot be deployed right away, remove or comment out the LoadModule mod_copy.c directive and restart ProFTPD. This eliminates the vulnerable command surface.
4. Restrict network access. Where FTP access is required only for specific clients, use firewall rules to limit port 21 (or your configured FTP port) to trusted IP ranges. This reduces but does not eliminate risk.
5. Conduct forensic triage. Per CISA guidance, treat potentially affected systems as candidates for compromise review. Check FTP logs for unexpected SITE CPFR and SITE CPTO commands, particularly from unauthenticated or anonymous sessions. Look for unexpected files in web-accessible directories.
6. Consider alternatives to FTP. SFTP (SSH File Transfer Protocol) and FTPS provide encrypted, authenticated alternatives. If your use case permits, migrating away from plain FTP eliminates an entire class of risk.
7. Cloud services: Follow BOD 26-04 guidance applicable to cloud-hosted instances and verify with your cloud provider whether managed FTP offerings are affected.

How Continuous External Testing Surfaces This Exposure

CVE-2015-3306 is a textbook example of a vulnerability that persists for years — even decades — in environments where asset visibility is incomplete. The flaw was disclosed in 2015 yet appeared in the CISA KEV catalog in 2026, meaning organizations are still running the affected software on internet-facing hosts.

Continuous external attack surface testing addresses this directly by:

• Discovering exposed FTP services across your entire internet-facing footprint, including forgotten servers, legacy appliances, and cloud deployments that may not appear in internal asset registers.
• Fingerprinting service versions to identify ProFTPD 1.3.5 instances and flag them against known vulnerability databases, including CISA KEV entries.
• Detecting loaded modules through banner analysis and protocol-level probing that reveals whether mod_copy is present — without attempting exploitation.
• Alerting on newly exposed assets so that a misconfiguration or infrastructure change that exposes an FTP port is caught within hours rather than discovered after a breach.
• Prioritising by KEV status and CVSS score so that a CVSS 10 / KEV-confirmed finding like CVE-2015-3306 surfaces at the top of your remediation queue, not buried in a list of hundreds.

A decade-old vulnerability with a perfect severity score appearing on a live internet-facing asset is not a hypothetical scenario — it is precisely what continuous external testing is designed to prevent from becoming an incident.

Frequently asked questions

Does an attacker need an FTP account to exploit CVE-2015-3306?

No. According to the NVD description and CISA KEV entry, the vulnerability allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands without authentication. No valid FTP credentials are required.

Is this vulnerability being actively exploited?

Yes. CISA added CVE-2015-3306 to the Known Exploited Vulnerabilities catalog on 8 October 2026, which by CISA's criteria means there is evidence of active exploitation. CISA's required action under BOD 26-04 mandates that organizations apply mitigations or discontinue use of the affected product.

If I disable anonymous FTP, am I protected?

Not necessarily. The access control failure in mod_copy is not exclusively tied to anonymous FTP access — the commands can be issued before authentication completes. Disabling anonymous access reduces your exposure but does not reliably eliminate it. The safest remediations are upgrading to a patched ProFTPD version or disabling the mod_copy module entirely.

My ProFTPD server is behind a firewall — does that protect me?

Network-level controls that restrict who can reach port 21 reduce the attack surface but are not a substitute for patching. If any untrusted host that can reach the FTP port is compromised or if the firewall rules are misconfigured, the vulnerability remains exploitable. Apply vendor mitigations as the primary control, with network restrictions as a defence-in-depth measure.