ProFTPD CVE-2015-3306: mod_copy file access added to KEV

On 8 October 2026 CISA added CVE-2015-3306 to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability affects ProFTPD, an FTP server for Linux and Unix systems. The flaw lies in the mod_copy module of ProFTPD 1.3.5 and lets a remote attacker read and write arbitrary files on the server through the FTP commands SITE CPFR and SITE CPTO.

The vulnerability is not new: it was published on 18 May 2015, and Debian, Fedora and openSUSE released their update advisories back in 2015. The KEV catalog, however, lists vulnerabilities for which CISA has evidence of active exploitation. Its inclusion is therefore a signal to take seriously for anyone still running unpatched ProFTPD servers.

What happened

CISA added CVE-2015-3306 to KEV as “ProFTPD Improper Access Control Vulnerability” and set 11 October 2026 as the deadline for US federal agencies: three days, a very short window. The catalog lists its use in ransomware campaigns as “unknown”.

The entry asks organisations to apply mitigations according to the vendor’s instructions, in line with Binding Operational Directive BOD 26-04 on prioritising security updates based on risk and with CISA’s forensics triage requirements. If no mitigations are available, the product should be discontinued. The entry also asks to evaluate the internet exposure of every asset.

The catalog gives no details on the attacks observed, the actors or the victims, nor does it explain why the vulnerability is only being added now.

Technical details

• CVE: CVE-2015-3306, published on 18 May 2015. The NVD record was updated on 9 October 2026 and is undergoing analysis again.
• Affected product and version: ProFTPD 1.3.5, mod_copy module. It is the only version listed in the NVD record.
• Commands involved: SITE CPFR (copy from) and SITE CPTO (copy to), which the module uses to copy files on the server.
• Effect: a remote attacker can read and write arbitrary files.
• Severity: CVSS 3.1 10.0 (critical), AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The attack is network-based, low-complexity, requires no privileges or user interaction, and affects confidentiality, integrity and availability, even beyond the vulnerable component (scope changed). CVSS 2: 10.0.
• Weakness: CWE-284 (Improper Access Control).
• Public code: the NVD references include two exploits on Exploit-DB, several Packet Storm pages (among them “ProFTPd CPFR/CPTO Proof Of Concept” and “ProFTPd 1.3.5 Remote Command Execution”) and a Rapid7 Metasploit module named proftpd_modcopy_exec. Judging by their titles, the public code goes beyond copying files and reaches command execution.
• Related advisories: the NVD record lists advisories from Debian (DSA-3263), Fedora and openSUSE, which shipped fixed packages.
• MITRE ATT&CK: exploiting an exposed service maps to T1190 (Exploit Public-Facing Application).

Impact for European and Italian organisations

An FTP server exists to exchange files: with this vulnerability an attacker can read files they should not see and write new ones where they should not. According to the CVSS vector no credentials are needed: all that matters is whether the service is reachable. The impact on confidentiality, integrity and availability is high.

The systems most at risk are those nobody has updated for years: old file exchange servers, forgotten virtual machines, hand-compiled installations that never received distribution updates. With public exploits available for more than ten years, a version 1.3.5 still exposed to the internet should be treated as a concrete risk.

For entities in scope of NIS2, the compromise of an exposed server is an incident to assess for notification to the national CSIRT, which in Italy is CSIRT Italia at ACN. The same applies to healthcare organisations, where file exchange servers may handle personal and clinical data.

What to do now

1. Take inventory: identify every system running ProFTPD, including internal servers, internet-facing ones and appliances that bundle it.
2. Check version and modules: the version listed as vulnerable is 1.3.5. Also check whether the mod_copy module is loaded in the configuration. If you use packages from a Linux distribution, check the status against the distribution’s advisory, not just the version number.
3. Update: install the fixed version indicated by the vendor or the updated package from your distribution. If you still find installations from that era, consider moving to a supported version.
4. If you cannot update, apply the mitigations provided by the vendor. If there are none, CISA says to discontinue the product.
5. Reduce exposure: check which FTP servers answer from the internet and whether that is really necessary.
6. Detect: search the FTP server logs for the SITE CPFR and SITE CPTO commands, especially from unknown addresses, and check the integrity of files in the folders the service can reach. If you find traces, treat the server as compromised and assess your notification obligations.

How ARXDOME helps

ARX Shield shows open vulnerabilities by machine and by package and highlights those already exploited by attackers, such as the CVEs in the KEV catalog: it helps you quickly find the servers with ProFTPD to update. ARX Expose checks the services your organisation exposes on the internet, the recognised products and their known vulnerabilities. ARX Sentry collects logs and events from Linux servers and monitors file integrity in the chosen folders, so an unexpected write does not go unnoticed.

Last updated: 8 October 2026