CVE-2015-3306

10.0 critical KEV · due 2026-10-11 exploit ×23 SSVC exploitation: active Analyzed

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

Fix

Public exploits 23

ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution (2) (remote · linux) Exploit-DB · verified · 2021-05-26
ProFTPd 1.3.5 - 'mod_copy' Command Execution (Metasploit) (remote · linux) Exploit-DB · verified · 2015-06-10
ProFTPD 1.3.5 Mod_Copy Command Execution (exploit module) Metasploit · verified · 2015-04-22
ProFTPd 1.3.5 - File Copy (remote · linux) Exploit-DB · verified · 2015-04-13
ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution (remote · linux) Exploit-DB · 2015-04-21
0xm4ud/ProFTPD_CVE-2015-3306 PoC on GitHub
JoseLRC97/ProFTPd-1.3.5-mod_copy-Remote-Command-Execution PoC on GitHub
Z3R0space/CVE-2015-3306 PoC on GitHub
bcononugbor-source/OpenVAS-Vulnerability-Analysis-Incident-Response-Report PoC on GitHub
canpilayda/proftpd-mod_copy-cve-2015-3306 PoC on GitHub
cd6629/CVE-2015-3306-Python-PoC PoC on GitHub
cdedmondson/Modified-CVE-2015-3306-Exploit PoC on GitHub
cved-sources/cve-2015-3306 PoC on GitHub
cybersensei-EH/hackviser_labs_CVE-2015-3306 PoC on GitHub
davidtavarez/CVE-2015-3306 PoC on GitHub
diegslva/cve-2015-3306-lab PoC on GitHub
donmedfor/CVE-2015-3306 PoC on GitHub
hackarada/cve-2015-3306 PoC on GitHub
jptr218/proftpd_bypass PoC on GitHub
netw0rk7/CVE-2015-3306-Home-Lab PoC on GitHub
and 3 more

Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.

CISA KEV required action · due 2026-10-11

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Added to the catalog 2026-10-08. CISA KEV

Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.

In the news 1

Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies The Hacker News · 2026-10-09

Change history 1

2026-10-15 00:45First seenCVSS 10.0 · in KEV · fedoraproject, debian, opensuseNVD modified 2026-10-09 16:17

Affected (CPE criteria) 10

cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:tumbleweed:-:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:15:sp7:*:*:-:-:*:*
cpe:2.3:o:suse:linux_enterprise_server:15:sp7:*:*:-:sap:*:*
cpe:2.3:a:proftpd:proftpd:1.3.5:*:*:*:*:*:*:*

References 29

http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157053.html Broken Link, Mailing List, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157054.html Broken Link, Mailing List, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157581.html Broken Link, Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-06/msg00020.html Mailing List, Third Party Advisory
http://packetstormsecurity.com/files/131505/ProFTPd-1.3.5-File-Copy.html Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/131555/ProFTPd-1.3.5-Remote-Command-Execution.html Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/131567/ProFTPd-CPFR-CPTO-Proof-Of-Concept.html Exploit, VDB Entry
http://packetstormsecurity.com/files/132218/ProFTPD-1.3.5-Mod_Copy-Command-Execution.html Exploit, VDB Entry
http://packetstormsecurity.com/files/162777/ProFTPd-1.3.5-Remote-Command-Execution.html Exploit, VDB Entry
http://www.debian.org/security/2015/dsa-3263 Mailing List, Third Party Advisory
http://www.rapid7.com/db/modules/exploit/unix/ftp/proftpd_modcopy_exec Third Party Advisory
http://www.securityfocus.com/bid/74238 Third Party Advisory
https://www.exploit-db.com/exploits/36742/ Exploit
https://www.exploit-db.com/exploits/36803/ Exploit
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157053.html Broken Link, Mailing List, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157054.html Broken Link, Mailing List, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157581.html Broken Link, Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-06/msg00020.html Mailing List, Third Party Advisory
http://packetstormsecurity.com/files/131505/ProFTPd-1.3.5-File-Copy.html Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/131555/ProFTPd-1.3.5-Remote-Command-Execution.html Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/131567/ProFTPd-CPFR-CPTO-Proof-Of-Concept.html Exploit, VDB Entry
http://packetstormsecurity.com/files/132218/ProFTPD-1.3.5-Mod_Copy-Command-Execution.html Exploit, VDB Entry
http://packetstormsecurity.com/files/162777/ProFTPd-1.3.5-Remote-Command-Execution.html Exploit, VDB Entry
http://www.debian.org/security/2015/dsa-3263 Mailing List, Third Party Advisory
http://www.rapid7.com/db/modules/exploit/unix/ftp/proftpd_modcopy_exec Third Party Advisory
http://www.securityfocus.com/bid/74238 Third Party Advisory
https://www.exploit-db.com/exploits/36742/ Exploit
https://www.exploit-db.com/exploits/36803/ Exploit
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3306 US Government Resource