{"id":"CVE-2015-3306","title":"The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.","published":"2015-05-18T15:59:10.743Z","updated":"2026-10-09T16:17:18.210Z","severity":"critical","cvssScore":10,"epss":0.99497,"epssPct":0.99945,"kev":true,"maturity":"weaponized","actionScore":100,"primaryVendor":"proftpd","primaryProduct":"proftpd","cweId":"CWE-284","fixAvailable":true,"tags":["pre-auth","authz","remote","no-ui"],"epssDelta7":0,"summary":"The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvssVersion":"3.1","cvssSource":"nvd-secondary","cweName":"Improper Access Control","kevAdded":"2026-10-08T00:00:00.000Z","kevDue":"2026-10-11T00:00:00.000Z","kevRansomware":"Unknown","source":"nvd","cna":"mitre","ssvc":{"exploitation":"active","automatable":"yes","impact":"total"},"sources":{"tr":"2026-10-01T11:24:25.940Z","adp":"2026-10-09T16:02:13.824Z","cna":"2026-10-09T16:02:13.824Z","kev":"2026-10-08T21:07:44.366Z","nvd":"2026-10-09T16:17:18Z","osv":"2026-11-13T03:18:18.039Z","epss":"2026-10-27","nuclei":"2026-11-13T03:18:10.620Z","cna_seen":"2026-09-29T10:48:17.722Z","exploitdb":"2026-11-13T03:17:58.683Z","github-poc":"2026-11-13T03:18:14.335Z","metasploit":"2026-11-13T03:18:09.107Z"},"cvssCna":null,"hasPatchRef":false,"credits":[],"counts":{"exploitdb":4,"metasploit":1,"nuclei":1,"githubPoc":18},"products":[{"vendor":"proftpd","product":"proftpd","cpe":"cpe:2.3:a:proftpd:proftpd"},{"vendor":"fedoraproject","product":"fedora","cpe":"cpe:2.3:o:fedoraproject:fedora"},{"vendor":"debian","product":"debian linux","cpe":"cpe:2.3:o:debian:debian_linux"},{"vendor":"opensuse","product":"tumbleweed","cpe":"cpe:2.3:o:opensuse:tumbleweed"},{"vendor":"suse","product":"linux enterprise server","cpe":"cpe:2.3:o:suse:linux_enterprise_server"}],"references":[{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157053.html","tags":"Broken Link,Mailing List,Third Party Advisory"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157054.html","tags":"Broken Link,Mailing List,Third Party Advisory"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157581.html","tags":"Broken Link,Mailing List,Third Party Advisory"},{"url":"http://lists.opensuse.org/opensuse-updates/2015-06/msg00020.html","tags":"Mailing List,Third Party Advisory"},{"url":"http://www.debian.org/security/2015/dsa-3263","tags":"Mailing List,Third Party Advisory"},{"url":"http://www.rapid7.com/db/modules/exploit/unix/ftp/proftpd_modcopy_exec","tags":"Third Party Advisory"},{"url":"http://www.securityfocus.com/bid/74238","tags":"Third Party Advisory"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3306","tags":"US Government Resource"}],"exploits":[{"source":"exploitdb","kind":"remote","date":"2015-06-10"},{"source":"exploitdb","kind":"remote","date":"2015-04-21"},{"source":"exploitdb","kind":"remote","date":"2021-05-26"},{"source":"exploitdb","kind":"remote","date":"2015-04-13"},{"source":"metasploit","kind":"exploit","date":"2015-04-22"},{"source":"nuclei","kind":"critical","date":null},{"source":"github-poc","kind":"stars:1","date":"2015-04-21"},{"source":"github-poc","kind":"stars:2","date":"2015-04-26"},{"source":"github-poc","kind":"stars:152","date":"2017-01-08"},{"source":"github-poc","kind":"stars:1","date":"2017-07-29"},{"source":"github-poc","kind":"stars:0","date":"2019-01-06"},{"source":"github-poc","kind":"stars:0","date":"2020-02-25"},{"source":"github-poc","kind":"stars:0","date":"2020-05-15"},{"source":"github-poc","kind":"stars:1","date":"2020-10-16"},{"source":"github-poc","kind":"stars:1","date":"2021-05-16"},{"source":"github-poc","kind":"stars:1","date":"2021-08-21"},{"source":"github-poc","kind":"stars:0","date":"2024-04-18"},{"source":"github-poc","kind":"stars:0","date":"2025-05-14"},{"source":"github-poc","kind":"stars:0","date":"2025-08-23"},{"source":"github-poc","kind":"stars:1","date":"2025-11-02"},{"source":"github-poc","kind":"stars:0","date":"2025-11-17"},{"source":"github-poc","kind":"stars:0","date":"2026-01-18"},{"source":"github-poc","kind":"stars:1","date":"2026-06-03"},{"source":"github-poc","kind":"stars:0","date":"2026-09-07"}],"analysis":null,"affectedVersions":[{"vendor":"debian","product":"debian linux","version":"7.0","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"debian","product":"debian linux","version":"8.0","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"debian","product":"debian linux","version":"9.0","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"fedoraproject","product":"fedora","version":"20","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"fedoraproject","product":"fedora","version":"21","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"fedoraproject","product":"fedora","version":"22","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"opensuse","product":"tumbleweed","version":"*","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"proftpd","product":"proftpd","version":"1.3.5","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"suse","product":"linux enterprise server","version":"15","vsi":null,"vse":null,"vei":null,"vee":null}],"source_attribution":"NVD (NIST), CVE Program, CISA KEV, FIRST EPSS, OSV. Aggregated by Noroxi."}