Proftpd Modcopy Exec

www.rapid7.com • October 8, 2026

This module exploits the SITE CPFR/CPTO mod_copy commands in ProFTPD version 1.3.5. Any unauthenticated client can leverage these commands to copy files from any part of the filesystem to a chosen destination. The copy commands are executed with the rights of the ProFTPD service, which by default runs under the privileges of the 'nobody' user. By using /proc/self/cmdline to copy a PHP payload to the website directory, PHP remote code execution is made possible.

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

Prioritise with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active exploitation has been confirmed as of October 8, 2026, with proof-of-concept code available. Internet-facing ProFTPD deployments, especially legacy systems, are at the highest risk. Administrators are advised to review logs for suspicious activity and restrict FTP access to trusted networks. Immediate action is required to mitigate this threat, including upgrading to a patched version or disabling the vulnerable module. 1 sources 86

Extracted Entities

Proftpd Modcopy Exec

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

MITRE ATT&CK (2)

Platforms (2)

Tools (1)