CVE-2015-3306

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2015-3306 10.0

ProFTPD · ProFTPD · Added 2026-10-08 · Published 2015-05-18

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityProFTPD Improper Access Control Vulnerability

VendorProFTPD

ProductProFTPD

Date added2026-10-08

Due date2026-10-11

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-284

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Descriptions

KEV: ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

NVD: The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-10-08 21:06 UTC

Wall time0.8s

Searches8

Component defaultno — ProFTPD's official mod_copy documentation states the module 'is not compiled by default' and must be added via --with-modules=mod_copy, DSO, or prxs; distribution packages commonly ship it enabled regardless (Debian's proftpd-dfsg was vulnerable per DSA-3263, and the Bug 4169 report shows a Debian 1.3.5rc3 server advertising CPFR/CPTO in `site help`)

Sources http://bugs.proftpd.org/show_bug.cgi?id=4169
https://github.com/proftpd/proftpd/pull/109
https://github.com/proftpd/proftpd/commit/35b65aaf7219be474f621a874ec77c85d9ec794d
https://raw.githubusercontent.com/proftpd/proftpd/v1.3.5a/doc/contrib/mod_copy.html
https://www.debian.org/security/2015/dsa-3263
https://github.com/t0kx/exploit-CVE-2015-3306
https://github.com/cd6629/CVE-2015-3306-Python-PoC
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/ftp/proftpd_modcopy_exec.rb
https://www.exploit-db.com/exploits/36742/
https://nvd.nist.gov/vuln/detail/CVE-2015-3306

Hunting hypothesis agent

Hunt FTP command logs or IDS alerts for pre-auth mod_copy SITE CPFR/SITE CPTO pairs copying /proc/self/cmdline or PHP into web paths like /var/www/backdoor.php, then web access logs for GET /backdoor.php?cmd=; xferlog omits SITE copies.

Research details

Componentmod_copy module (contrib/mod_copy.c) — SITE CPFR/SITE CPTO server-side file-copy commands

PreconditionsNo authentication required — any unauthenticated TCP client that can reach the FTP control port (normally 21/tcp) can issue SITE CPFR/SITE CPTO. Target must run ProFTPD 1.3.5 (rc through release) with mod_copy built in; upstream fixed the flaw in 1.3.5a / 1.3.6rc1. Achieving RCE further needs a web-server-writable document root (the proftpd daemon often runs as nobody) plus a PHP interpreter to execute the dropped shell. agent

DeliveryUnauthenticated FTP control-channel commands (SITE CPFR/SITE CPTO) copying server-side files; optional PHP webshell drop into a web-served directory for RCE

Public PoCyes

PoC URLs https://github.com/t0kx/exploit-CVE-2015-3306
https://github.com/cd6629/CVE-2015-3306-Python-PoC
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/ftp/proftpd_modcopy_exec.rb
https://www.exploit-db.com/exploits/36742/ Third-party repos; verify before use.

Advisoryhttp://bugs.proftpd.org/show_bug.cgi?id=4169

Exploit notesPre-authentication and low complexity: the public exploits are raw-socket FTP command sequences needing no credentials. Both PoCs read (t0kx/exploit-CVE-2015-3306 and cd6629/CVE-2015-3306-Python-PoC) send `SITE CPFR /proc/self/cmdline`, then `SITE CPTO /tmp/.<?php ... ?>`, then `SITE CPTO <webroot>/backdoor.php` (or shell.php) and trigger the shell with an HTTP GET ?cmd=; the Metasploit module proftpd_modcopy_exec automates the same chain (ExcellentRanking, IOC_IN_LOGS). Copies run as the proftpd daemon user (commonly nobody), so the webshell step needs a writable web root; a read-only variant copies /etc/passwd or any readable file to an attacker-chosen path, answered with `250 Copy successful`. EDB-36742 hosts a copy of the exploit.

SummaryProFTPD 1.3.5's mod_copy module accepts SITE CPFR/SITE CPTO from unauthenticated FTP clients, giving pre-authentication arbitrary file read and write on the server as the proftpd daemon user. Public exploits turn this into remote code execution by copying /proc/self/cmdline — whose contents carry a PHP payload supplied on the command line — into a web-served directory as backdoor.php and invoking it over HTTP (Metasploit proftpd_modcopy_exec, EDB-36742, and multiple GitHub PoCs). Upstream fixed the flaw in 1.3.5a and 1.3.6rc1 (ProFTPD Bug 4169, GitHub PR 109); CISA added it to the KEV catalog on 2026-10-08 with a 2026-10-11 due date.

Tia coverage

First reported2026-10-08

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

cisa-adds-five-exploited-vulnerabilities-to-kev-catalog

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.