Zero Radar
← feed
CriticalVulnerabilityCVE-2015-3306updated 25 Oct 2026, 17:35 UTC

ProFTPD mod_copy flaw lets outsiders read and write server files

A file-transfer server called ProFTPD has a weakness that lets someone outside the network copy or overwrite files on the server without logging in properly. Attackers can use it to steal or tamper with data.

Exploited (CISA KEV)Official, 2 sources
SeverityCriticalCVSS 10 of 10
Being exploited?YesConfirmed by CISA KEV · 8 Oct 2026,
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Remote attackerConnects to the FTP service from the internet
  2. 2ProFTPD serverAccepts SITE CPFR and CPTO commands
  3. 3Arbitrary filesCopied or overwritten without authorization
  4. ResultAttacker reads and writes server files

What happened

The mod_copy module in ProFTPD 1.3.5 has an improper access control flaw, allowing remote attackers to read and write arbitrary files via the SITE CPFR and SITE CPTO commands.

Why it is dangerous: Attackers can access and change files on the server, which can expose sensitive data and let them plant malicious content. Any internet-facing ProFTPD server running the affected version is at risk.

Are you affected?

You are affected if you run ProFTPD 1.3.5 with the mod_copy module enabled and the FTP service is reachable from the internet or untrusted networks.

ProFTPD 1.3.5 (mod_copy module)

What to do

  1. Check whether ProFTPD 1.3.5 is installed and whether mod_copy is enabled.
  2. Disable the mod_copy module or block the SITE CPFR and SITE CPTO commands until a fix is applied.
  3. Apply the vendor's fixed version or mitigation as directed by CISA guidance (BOD 26-04).
  4. Review server logs and file integrity for unexpected copies or changes, following CISA's forensics triage requirements.

Timeline

  1. 13 May 2022, 01:09 UTC
    Publicly disclosed
  2. 8 Oct 2026, 00:00 UTC
    Reported by CISA KEV · CISA KEV
  3. 25 Oct 2026, 17:35 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2015-3306 · GHSA-4mfj-5wr8-x32q
CVSS
10 / 10
EPSS
99% chance of exploitation within 30 days
Disclosed
13 May 2022, 01:09 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 17:35 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

ProFTPD mod_copy flaw lets outsiders read and write server files · Zero Radar