---
title: "ProFTPD mod_copy CVE-2015-3306: 2015 Bug Added to KEV"
url: https://erroneo.us/security/briefs/proftpd-mod-copy-cve-2015-3306-kev/
description: "Unauthenticated file copy in ProFTPD 1.3.5 mod_copy, fixed in 2015, joins KEV after a joint advisory tied it to China-linked actors. Find old FTP servers."
type: security-brief
section: "Security Digest"
date_published: 2026-10-08
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2015-3306"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# ProFTPD mod_copy CVE-2015-3306: 2015 Bug Added to KEV

**Verdict: Check exposure.** Nearly everyone fixed this a decade ago; the real job is finding any ProFTPD 1.3.5-era build with mod_copy still answering on port 21, usually inside old appliances, and replacing or removing it.

- **Who must act:** Operators of internet-facing FTP servers, NAS boxes, hosting servers or embedded appliances running ProFTPD 1.3.5 or older builds with mod_copy loaded and no 2015 patch.
- **Who can relax:** Anyone on ProFTPD 1.3.5a or later, on a distribution package patched in 2015, or running a build without mod_copy, which upstream does not compile by default.
- **Affected:** ProFTPD 1.3.5 with mod_copy loaded (CVE record); Debian proftpd-dfsg before 1.3.4a-5+deb7u3 (wheezy) and 1.3.5-1.1+deb8u1 (jessie)
- **Fixed:** ProFTPD 1.3.5a and 1.3.6rc1 (2015); Debian DSA-3263-1 packages (May 19, 2015); Current upstream: ProFTPD 1.3.9d (Aug 14, 2026)
- **CVEs:** CVE-2015-3306
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Scan your external address ranges for FTP on port 21 and flag any banner reporting ProFTPD 1.3.5 or older.
2. On each ProFTPD host, run proftpd -v and proftpd -l, and grep the configuration for LoadModule mod_copy.c, to see the version and whether mod_copy is present.
3. Upgrade to a current ProFTPD release or a distro package with the 2015 fix, and replace appliances whose firmware still ships 1.3.5.
4. If you do not need server-side copy, stop loading mod_copy; on 1.3.6rc1 and later you can also set CopyEngine off.
5. Close FTP to the internet where it is not required, or move users to SFTP, as the joint advisory recommends disabling unused file-sharing services.

### How to check if you are affected

- Search FTP command logs or port 21 captures for SITE CPFR and SITE CPTO, especially in sessions with no successful login.
- Look for unexpected .php or script files in web roots on the same host, the classic follow-on of copying attacker input into a served file.
- Check for copies of /etc/passwd, configuration files or keys in FTP-served or world-readable directories.
- Compare the indicators published with advisory AA26-281A against your logs, keeping in mind that some date back to 2016.

## What happened

On October 8, 2026, the FBI, CISA, NSA and agencies from the UK, Australia, Canada, Japan, New Zealand and Spain published joint advisory [AA26-281A](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a). It covers actors enabled by Integrity Technology Group, a China-based company. CISA [says](https://www.cisa.gov/news-events/news/cisa-fbi-nsa-and-international-partners-warn-china-based-cybersecurity-company-enabling-threat) the actors it enables use techniques consistent with Flax Typhoon, Ethereal Panda and Red Juliett. Appendix B lists eight "successfully exploited" CVEs, drawn from penetration-testing scripts in a tool called MicroScan. The actors have used it since as early as 2017. Five of the eight were added to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3306) that day with an October 11 federal deadline. One is CVE-2015-3306 in ProFTPD. The others are ONLYOFFICE Docs CVE-2021-3199, Strapi CVE-2023-22894, Apache Struts CVE-2016-3081 and ISC BIND CVE-2015-5477.

The bug itself is eleven years old. In April 2015, Vadim Melihow reported to ProFTPD ([bug 4169](http://bugs.proftpd.org/show_bug.cgi?id=4169)) that `mod_copy` accepted `SITE CPFR` and `SITE CPTO` from *unauthenticated* clients. His example copied `/etc/passwd` to `/tmp`. A second example got PHP code into the server log through a failed command, then copied `/proc/self/fd/3` into `/var/www/test.php`. That turns a file-copy bug into remote code execution on servers that also host a website. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2015-3306) cites public exploits, including a Metasploit module. CISA's enrichment scores it CVSS 3.1 10.0, and [NVD](https://nvd.nist.gov/vuln/detail/CVE-2015-3306) gives 10.0 on CVSS 2.

## Who is affected

ProFTPD 1.3.5 with `mod_copy` loaded. Upstream fixed it in 1.3.5a and 1.3.6rc1 in 2015 and added a `CopyEngine` switch. The [module documentation](http://www.proftpd.org/docs/contrib/mod_copy.html) says mod_copy "is not compiled by default," but distributions shipped it. Debian's [DSA-3263-1](https://lists.debian.org/debian-security-announce/2015/msg00154.html) fixed both wheezy (1.3.4a) and jessie (1.3.5) packages. Current upstream is [1.3.9d](https://github.com/proftpd/proftpd/releases/tag/v1.3.9d). Today the exposed population is whatever never got updated: old NAS and storage appliances, end-of-life Linux servers, hosting boxes and embedded devices with frozen firmware.

## Do you really need to act?

Only if you still have such a box, and you may not know you do. The KEV listing is not evidence of a new campaign. [VulnCheck](https://www.vulncheck.com/blog/integrity-technology-group-advisory) notes that the first exploitation evidence for this CVE in its KEV is the report date itself, and quotes the advisory's warning that many indicators are old, "some dating back to 2016." What the advisory does show is that a well-resourced, state-linked ecosystem keeps this exploit in its scanning kit. It says these actors focus their scans on ports 21 (FTP), 22, 53, 80, 443 and 1080. Anything still vulnerable and reachable will be found.

So the verdict is check exposure, not panic. If a scan of your ranges turns up nothing older than ProFTPD 1.3.5a, you are done. If it finds a 1.3.5 banner, fix it today and investigate the host. US federal agencies had until October 11 to patch or stop using affected products, as [The Hacker News](https://thehackernews.com/2026/10/flax-typhoon-exploits-five-flaws-as.html) notes.

## What to do now

1. Scan external ranges for port 21 and collect banners, for example `nmap -sV -p21 <range>`. Flag anything reporting ProFTPD 1.3.5 or older.
2. On each ProFTPD host, run `proftpd -v` for the version and `proftpd -l` for compiled-in modules. Also run `grep -ri 'mod_copy' /etc/proftpd*` to find DSO loads.
3. Upgrade to a current release or a distro package carrying the 2015 fix. For appliances, apply vendor firmware or retire the device.
4. Stop loading `mod_copy` if you do not use server-side copy. On 1.3.6rc1 and later, `CopyEngine off` disables it at runtime.
5. Follow the advisory's guidance to disable unused file-sharing services. Remove FTP from the internet or replace it with SFTP.

## How to tell if you were hit

Search FTP command logs (an `ExtendedLog`, if configured) or packet captures for `SITE CPFR` and `SITE CPTO`, especially before any successful `USER`/`PASS`. On hosts that also serve web content, look for unexpected `.php` or script files in document roots, and for copies of `/etc/passwd`, configs or keys in FTP-served or world-readable directories. Check the advisory's downloadable IOC set against firewall and proxy logs. If a vulnerable build was internet-facing, rebuild the host rather than cleaning it, and rotate any credentials stored on it.

## Timeline

- Apr 7, 2015 — Vadim Melihow's report is filed as ProFTPD bug 4169, and a fix is merged the same day.
- May 19, 2015 — Debian publishes DSA-3263-1.
- May 28, 2015 — ProFTPD marks the bug resolved in 1.3.5a and 1.3.6rc1.
- Oct 8, 2026 — Joint advisory AA26-281A is published, and CISA adds CVE-2015-3306 and four other old CVEs to KEV.
- Oct 11, 2026 — CISA's remediation deadline for federal agencies.

## Sources

1. [ProFTPD Bugzilla — Bug 4169: Unauthenticated copying of files via SITE CPFR/CPTO allowed by mod_copy](http://bugs.proftpd.org/show_bug.cgi?id=4169)
2. [ProFTPD — mod_copy module documentation](http://www.proftpd.org/docs/contrib/mod_copy.html)
3. [CVE record — CVE-2015-3306](https://www.cve.org/CVERecord?id=CVE-2015-3306)
4. [NVD — CVE-2015-3306](https://nvd.nist.gov/vuln/detail/CVE-2015-3306)
5. [CISA — Known Exploited Vulnerabilities: CVE-2015-3306](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3306)
6. [CISA, FBI, NSA et al. — AA26-281A: Chinese government-linked cyber threat actors combine automated and hands-on hacking tools](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a)
7. [CISA — CISA, FBI, NSA and international partners warn of China-based cybersecurity company enabling threat actors](https://www.cisa.gov/news-events/news/cisa-fbi-nsa-and-international-partners-warn-china-based-cybersecurity-company-enabling-threat)
8. [Debian — DSA-3263-1 proftpd-dfsg security update](https://lists.debian.org/debian-security-announce/2015/msg00154.html)
9. [ProFTPD — v1.3.9d release](https://github.com/proftpd/proftpd/releases/tag/v1.3.9d)
10. [VulnCheck — Expanding visibility into Chinese government-linked cyber threat actors](https://www.vulncheck.com/blog/integrity-technology-group-advisory)
11. [The Hacker News — Flax Typhoon exploits five flaws as CISA sets October 11 deadline](https://thehackernews.com/2026/10/flax-typhoon-exploits-five-flaws-as.html)

---
Source page: https://erroneo.us/security/briefs/proftpd-mod-copy-cve-2015-3306-kev/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt