ProFTPD mod_copy CVE-2015-3306: 2015 Bug Added to KEV

What to do

1. Scan your external address ranges for FTP on port 21 and flag any banner reporting ProFTPD 1.3.5 or older.
2. On each ProFTPD host, run proftpd -v and proftpd -l, and grep the configuration for LoadModule mod_copy.c, to see the version and whether mod_copy is present.
3. Upgrade to a current ProFTPD release or a distro package with the 2015 fix, and replace appliances whose firmware still ships 1.3.5.
4. If you do not need server-side copy, stop loading mod_copy; on 1.3.6rc1 and later you can also set CopyEngine off.
5. Close FTP to the internet where it is not required, or move users to SFTP, as the joint advisory recommends disabling unused file-sharing services.

How to check if you are affected or compromised

• Search FTP command logs or port 21 captures for SITE CPFR and SITE CPTO, especially in sessions with no successful login.
• Look for unexpected .php or script files in web roots on the same host, the classic follow-on of copying attacker input into a served file.
• Check for copies of /etc/passwd, configuration files or keys in FTP-served or world-readable directories.
• Compare the indicators published with advisory AA26-281A against your logs, keeping in mind that some date back to 2016.

What happened#

On October 8, 2026, the FBI, CISA, NSA and agencies from the UK, Australia, Canada, Japan, New Zealand and Spain published joint advisory AA26-281A. It covers actors enabled by Integrity Technology Group, a China-based company. CISA says the actors it enables use techniques consistent with Flax Typhoon, Ethereal Panda and Red Juliett. Appendix B lists eight "successfully exploited" CVEs, drawn from penetration-testing scripts in a tool called MicroScan. The actors have used it since as early as 2017. Five of the eight were added to the KEV catalog that day with an October 11 federal deadline. One is CVE-2015-3306 in ProFTPD. The others are ONLYOFFICE Docs CVE-2021-3199, Strapi CVE-2023-22894, Apache Struts CVE-2016-3081 and ISC BIND CVE-2015-5477.

The bug itself is eleven years old. In April 2015, Vadim Melihow reported to ProFTPD (bug 4169) that mod_copy accepted SITE CPFR and SITE CPTO from unauthenticated clients. His example copied /etc/passwd to /tmp. A second example got PHP code into the server log through a failed command, then copied /proc/self/fd/3 into /var/www/test.php. That turns a file-copy bug into remote code execution on servers that also host a website. The CVE record cites public exploits, including a Metasploit module. CISA's enrichment scores it CVSS 3.1 10.0, and NVD gives 10.0 on CVSS 2.

Who is affected#

ProFTPD 1.3.5 with mod_copy loaded. Upstream fixed it in 1.3.5a and 1.3.6rc1 in 2015 and added a CopyEngine switch. The module documentation says mod_copy "is not compiled by default," but distributions shipped it. Debian's DSA-3263-1 fixed both wheezy (1.3.4a) and jessie (1.3.5) packages. Current upstream is 1.3.9d. Today the exposed population is whatever never got updated: old NAS and storage appliances, end-of-life Linux servers, hosting boxes and embedded devices with frozen firmware.

Do you really need to act?#

Only if you still have such a box, and you may not know you do. The KEV listing is not evidence of a new campaign. VulnCheck notes that the first exploitation evidence for this CVE in its KEV is the report date itself, and quotes the advisory's warning that many indicators are old, "some dating back to 2016." What the advisory does show is that a well-resourced, state-linked ecosystem keeps this exploit in its scanning kit. It says these actors focus their scans on ports 21 (FTP), 22, 53, 80, 443 and 1080. Anything still vulnerable and reachable will be found.

So the verdict is check exposure, not panic. If a scan of your ranges turns up nothing older than ProFTPD 1.3.5a, you are done. If it finds a 1.3.5 banner, fix it today and investigate the host. US federal agencies had until October 11 to patch or stop using affected products, as The Hacker News notes.

What to do now#

1. Scan external ranges for port 21 and collect banners, for example nmap -sV -p21 <range>. Flag anything reporting ProFTPD 1.3.5 or older.
2. On each ProFTPD host, run proftpd -v for the version and proftpd -l for compiled-in modules. Also run grep -ri 'mod_copy' /etc/proftpd* to find DSO loads.
3. Upgrade to a current release or a distro package carrying the 2015 fix. For appliances, apply vendor firmware or retire the device.
4. Stop loading mod_copy if you do not use server-side copy. On 1.3.6rc1 and later, CopyEngine off disables it at runtime.
5. Follow the advisory's guidance to disable unused file-sharing services. Remove FTP from the internet or replace it with SFTP.

How to tell if you were hit#

Search FTP command logs (an ExtendedLog, if configured) or packet captures for SITE CPFR and SITE CPTO, especially before any successful USER/PASS. On hosts that also serve web content, look for unexpected .php or script files in document roots, and for copies of /etc/passwd, configs or keys in FTP-served or world-readable directories. Check the advisory's downloadable IOC set against firewall and proxy logs. If a vulnerable build was internet-facing, rebuild the host rather than cleaning it, and rotate any credentials stored on it.

Timeline#

• Apr 7, 2015 — Vadim Melihow's report is filed as ProFTPD bug 4169, and a fix is merged the same day.
• May 19, 2015 — Debian publishes DSA-3263-1.
• May 28, 2015 — ProFTPD marks the bug resolved in 1.3.5a and 1.3.6rc1.
• Oct 8, 2026 — Joint advisory AA26-281A is published, and CISA adds CVE-2015-3306 and four other old CVEs to KEV.
• Oct 11, 2026 — CISA's remediation deadline for federal agencies.

Vulnerability records

• CVE-2015-3306 · KEV 2026-10-08 · The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. ProFTPD Bugzilla — Bug 4169: Unauthenticated copying of files via SITE CPFR/CPTO allowed by mod_copy bugs.proftpd.org
2. ProFTPD — mod_copy module documentation proftpd.org
3. CVE record — CVE-2015-3306 cve.org
4. NVD — CVE-2015-3306 nvd.nist.gov
5. CISA — Known Exploited Vulnerabilities: CVE-2015-3306 cisa.gov
6. CISA, FBI, NSA et al. — AA26-281A: Chinese government-linked cyber threat actors combine automated and hands-on hacking tools cisa.gov
7. CISA — CISA, FBI, NSA and international partners warn of China-based cybersecurity company enabling threat actors cisa.gov
8. Debian — DSA-3263-1 proftpd-dfsg security update lists.debian.org
9. ProFTPD — v1.3.9d release github.com
10. VulnCheck — Expanding visibility into Chinese government-linked cyber threat actors vulncheck.com

Coverage and analysis

1. The Hacker News — Flax Typhoon exploits five flaws as CISA sets October 11 deadline thehackernews.com