Unauthenticated file copy via mod_copy SITE CPFR/CPTO in ProFTPD gives remote code execution (CVE-2015-3306)
CISA added this flaw to KEV on 2026-10-08 with a remediation deadline of 2026-10-11, released alongside joint advisory AA26-281A on Chinese government-linked actors, so an internet-facing ProFTPD still running the vulnerable 1.3.5 build with mod_copy loaded should be treated as a known target and fixed now.
ProFTPD's mod_copy module accepts SITE CPFR and SITE CPTO commands from any client before authentication, letting an attacker copy files from anywhere on the filesystem to a destination of their choosing. Copying attacker-controlled content into a web root or other executed location yields remote command execution, and a Metasploit module automates the attack against ProFTPD 1.3.5.
Affected: ProFTPD 1.3.5 with the mod_copy module enabled (per the Metasploit module description)
How to Test
Check the installed ProFTPD version and whether the mod_copy module is loaded; if a plain FTP client can issue SITE CPFR / SITE CPTO before logging in and the server accepts them, the host is exposed. Review FTP logs for SITE CPFR and SITE CPTO commands from unauthenticated or unexpected sessions, and look for unexpected new files in web roots, cron directories, or other writable locations reachable by the FTP process, which indicate a successful copy.
How to Patch
Install your distribution's fixed proftpd packages (Debian DSA-3263; the openSUSE and Fedora updates referenced in the advisory list) or upgrade off ProFTPD 1.3.5 to a release where the mod_copy fix is included. If an upgrade must wait, unload or disable the mod_copy module so SITE CPFR/CPTO are no longer served, and restrict FTP exposure to trusted networks.