CVE-2015-3306: ProFTPD mod_copy Arbitrary File Read/Write RCE (KEV)

CVE-2015-3306 is an improper-access-control vulnerability in ProFTPD 1.3.5's mod_copy module: the SITE CPFR and SITE CPTO FTP commands perform no authentication or access check, letting a remote, unauthenticated attacker copy arbitrary files anywhere the FTP process can write — including placing a web-accessible script to achieve remote code execution — and CISA added this decade-old flaw to the Known Exploited Vulnerabilities catalog on 2026-10-08 after observing renewed in-the-wild exploitation.

CVE-2015-3306 is an improper access control vulnerability (CWE-284) in ProFTPD. NVD's description states: "The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands" (NVD).

NVD's own primary score, recorded under the older CVSS v2.0 scheme, is 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C); a CISA-ADP secondary submission scores it under CVSS v3.1 at the same 10.0 (critical, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) — both scores agree the flaw is maximally severe (NVD).

ProFTPD's own project site did not respond during this run (connection refused on repeated attempts), so remediation detail here is sourced to Debian's security advisory DSA-3263 instead, and labelled as such: Debian describes the flaw as allowing "unauthenticated users to copy files around on the server, and possibly to execute arbitrary code," and shipped fixed packages 1.3.4a-5+deb7u3 for oldstable (Wheezy) and 1.3.5-1.1+deb8u1 for stable (Jessie) (Debian Security Advisory DSA-3263-1).

Although disclosed in 2015, CISA added CVE-2015-3306 to the KEV catalog on 2026-10-08, with a required-action due date of 2026-10-11 under Binding Operational Directive 26-04, and lists known ransomware campaign use as "Unknown" (CISA KEV).

As of 2026-10-26, FIRST scores the probability of exploitation at 0.995 (99.944th percentile) — one of the highest EPSS scores observed for any advisory on this site, consistent with mass scanning or exploitation of still-unpatched, decade-old ProFTPD installs now that the flaw has been re-weaponized (FIRST EPSS).

Any ProFTPD installation still running an affected 1.3.x build with mod_copy loaded should disable the module or upgrade to a patched package immediately, and be checked for signs of prior unauthorized file-write activity given the near-maximal EPSS score and active KEV listing.

• The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write arbitrary files via the site cpfr and site cpto commands. — NVD
• NVD primary CVSS v2.0 score is 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C); CISA-ADP secondary CVSS v3.1 score is also 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). — NVD
• Describes the flaw as allowing unauthenticated users to copy files around the server and possibly execute arbitrary code; fixed in Debian package versions 1.3.4a-5+deb7u3 (oldstable) and 1.3.5-1.1+deb8u1 (stable). Cited because ProFTPD's own project site was unreachable (connection refused) during this run. — Debian Security Advisory DSA-3263-1
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-10-08, due date 2026-10-11, known ransomware campaign use listed as Unknown. — CISA KEV
• EPSS score is 0.995 (99.944th percentile) as of 2026-10-26. — FIRST EPSS