CVE-2015-3306: ProFTPD Improper Access Control Vulnerability

Critical severity, CVSS 10.0. Actively exploited: in CISA KEV since 2026-10-08. EPSS: 99.5% chance of exploitation in the next 30 days.

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

Affected products

• Debian Debian Linux: version 7.0 only; version 8.0 only; version 9.0 only
• Fedoraproject Fedora: version 20 only; version 21 only; version 22 only
• Opensuse Tumbleweed: affected versions not specified
• ProFTPD ProFTPD: version 1.3.5 only
• Suse Linux Enterprise Server: version 15 only

Published 2015-05-18. Last modified 2026-10-09.