Back Redpacketsecurity

CVE Alert: CVE-2015-3306 – n/a – n/a

Redpacketsecurity •admin • October 8, 2026

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

**Risk verdict:** Urgent: active exploitation is flagged and working exploit material is available; treat as priority 1.

**Why this matters:** An attacker may use the FTP service to access or alter files without valid credentials, potentially exposing sensitive data or changing application content. Where written files can be executed by another service, this may provide a route to code execution and a foothold for further compromise.

**Most likely attack path:** A remotely reachable FTP service is the key precondition; exploitation requires neither user action nor prior privileges. The attacker can act within the FTP service’s security context, and impact may cross into other services or data if that account can write to shared locations.

**Who is most exposed:** Internet-facing ProFTPD deployments are at greatest risk, particularly legacy file-transfer servers and hosts where FTP shares paths with web applications or business data.

Alert on `SITE CPFR` or `SITE CPTO` commands, especially in unusual sequences or from unfamiliar sources.

Review FTP logs for anonymous or unexpected sessions and repeated file-operation failures.

Check web roots, temporary directories and shared storage for recently created or altered files.

Correlate FTP activity with web-server execution, new processes or unexpected outbound connections.

Mitigation and prioritisation

Identify affected hosts and upgrade to a vendor-supported fixed release; verify the module is not enabled where unnecessary.

Restrict FTP access to trusted networks or VPN, and disable the service if it is not required.

Until patched, block the relevant copy commands or disable the module; validate controls against legitimate workflows.

Review file permissions and investigate for compromise before restoring normal service; coordinate changes with file-transfer owners.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active exploitation has been confirmed as of October 8, 2026, with proof-of-concept code available. Internet-facing ProFTPD deployments, especially legacy systems, are at the highest risk. Administrators are advised to review logs for suspicious activity and restrict FTP access to trusted networks. Immediate action is required to mitigate this threat, including upgrading to a patched version or disabling the vulnerable module. 1 sources 86

Extracted Entities

Attack Types (1)

Data Breach

CVEs (1)

CVE-2015-3306