ProFTPD: Arbitrary file read and write via mod_copy (SITE CPFR/CPTO)

Summary

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write arbitrary files on the server using the SITE CPFR and SITE CPTO commands. The CVSS vector requires no privileges and no user interaction, so the flaw can be exploited without a valid login. Public exploit code exists, and CISA lists the vulnerability as known exploited.

Affected

• ProFTPD 1.3.5 (per NVD)
• Some secondary sources also name 1.3.4e (unverified)

Fixed in

• Debian DSA-3263-1: wheezy 1.3.4a-5+deb7u3, jessie 1.3.5-1.1+deb8u1, unstable 1.3.5-2
• Upstream fixed version: unconfirmed. Tenable cites ProFTPD 1.3.5a or 1.3.6rc1 and later; verify on the ProFTPD website before relying on it.

Workaround

• Disable the mod_copy module in the ProFTPD configuration if patching is not immediately possible (commonly cited mitigation)
• Block external access to the FTP service with a firewall allow-list or VPN

Exploitation

• CISA KEV: listed as known exploited, added 2026-10-08 (not verified on the cisa.gov catalogue)
• Public proof-of-concept code and a Metasploit module exist
• A reported link to the Flax Typhoon group is unverified

Our recommendation

• Inventory all FTP servers, including containers and legacy hosts, and identify ProFTPD versions
• Update ProFTPD to the current release or the distribution's fixed package; treat 1.3.5 and older builds as urgent
• Disable mod_copy and restrict FTP access until the update is installed
• Review FTP logs for SITE CPFR and SITE CPTO requests and treat any hit as a potential incident

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (18 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  xyk0x/cpx_proftpd · nootropics/propane · t0kx/exploit-CVE-2015-3306 · davidtavarez/CVE-2015-3306 · cved-sources/cve-2015-3306
• Metasploit module exploit/unix/ftp/proftpd_modcopy_exec – ProFTPD 1.3.5 Mod_Copy Command Execution
• Exploit-DB EDB-ID 49908 – ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution (2) 26 May 2021
• Exploit-DB EDB-ID 37262 – ProFTPd 1.3.5 - 'mod_copy' Command Execution (Metasploit) 10 Jun 2015
• Exploit-DB EDB-ID 36803 – ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution 21 Apr 2015
• Exploit-DB EDB-ID 36742 – ProFTPd 1.3.5 - File Copy 13 Apr 2015

Research sources

• Debian Security Advisory DSA-3263 www.debian.org
• CISA Known Exploited Vulnerabilities Catalog www.cisa.gov
• Tenable Nessus plugin 84215 www.tenable.com
• Debian Security Tracker CVE-2015-3306 security-tracker.debian.org
• Exploit-DB 36742 www.exploit-db.com
• Rapid7 Metasploit module proftpd_modcopy_exec www.rapid7.com
• xhack.io analysis of CVE-2015-3306 xhack.io
• BleepingComputer: ProFTPD vulnerability lets users copy files www.bleepingcomputer.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 13:22.