SECURITY_THREAT_PULSE
LIVE
LAST UPDATED
FIRST SEEN
11 SOURCES ON THIS EVENT
▲ ACT NOWCVE-2015-3306 · CVSS 10.0

ProFTPD: attackers can gain admin rights

AFFECTSProFTPD

OFFICIAL NAME: ProFTPD Improper Access Control Vulnerability

WHAT IT IS · FILE TRANSFERIt holds files you swap with customers and partners, a common target for bulk data theft.

DO THIS FIRSTPatch it today and check it for files or accounts you do not recognize. Not sure if you use it? Send this page to your IT provider or security lead and ask.

TECHNICAL SUMMARY ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

WHY THIS VERDICT Attacks are confirmed. Ready-made attack tools are public. The severity score is critical (10.0). The exploit prediction score is 99%.

WHY IT RANKS HERE Exploitation is confirmed by an authoritative source. The product faces the internet or gives remote access. Ready-made attack tools are public.

HIGHEST CONFIRMED RUNG
EXPLOITED
CISA KEV
LISTED
EXPLOIT CODE
READY TO USE
// EVIDENCE LADDER

How far has it climbed?

CONFIRMED
REPORTED
NO EVIDENCE

  1. 01 TALK

    ▨ REPORTED, NOT CONFIRMED
    NEWEST EVIDENCE · 1 SOURCE

    CVE-2015-3306 discussed publicly (CIRCL sighting). CVE-2015-3306 discussed publicly (CIRCL sighting).

  2. 02 EXPOSED

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    We have no source that counts exposed systems yet. Internet scan data needs a partnership we do not have. No evidence here does not mean nothing is exposed.

  3. 03 TRIED

    ■ CONFIRMED
    NEWEST EVIDENCE · 2 INDEPENDENT SOURCES

    Attacks that worked are confirmed (step 4), so attempts count as confirmed too.

  4. 04 EXPLOITED

    ■ CONFIRMED
    NEWEST EVIDENCE · 2 INDEPENDENT SOURCES

    ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. CISA Vulnrichment marks CVE-2015-3306 as actively exploited.

  5. 05 DAMAGE

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    Breach notices and filings rarely name the flaw that was used, so we cannot link them to this event yet. No evidence here does not mean no harm.

// THE CLOCK

When each thing happened

  1. DISCLOSED
    CVE-2015-3306 published
  2. EXPLOIT CODE PUBLIC
    Exploit-DB
  3. FIRST ATTACK REPORT
    CISA Known Exploited Vulnerabilities
  4. CISA KEV LISTING
    CISA KEV listing
  5. US FEDERAL DEADLINE
    CISA deadline for US federal agencies
Attacks were reported 4161 days after disclosure. CISA listed it 4161 days after disclosure.

THE FIX

CISA's instruction: apply the vendor's fix, or stop using the product if no fix exists. The deadline CISA set for US federal agencies, Oct 11, 2026, has passed. It is a US government deadline; use it as a guide.

// ASK YOUR TEAM

Questions to ask this week

// TIMELINE · PACIFIC TIME

How it unfolded

  1. APR 12, 2015
    Exploit-DB entry: ProFTPd 1.3.5 - File Copy
  2. APR 20, 2015
    Exploit-DB entry: ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution
  3. APR 21, 2015
    18 public GitHub repositories claim a proof of concept for CVE-2015-3306
  4. APR 21, 2015
    Metasploit exploit module: ProFTPD 1.3.5 Mod_Copy Command Execution
  5. Attack activity. MAY 18, 2015
    CISA Vulnrichment marks CVE-2015-3306 as actively exploited
  6. JUN 9, 2015
    Exploit-DB entry: ProFTPd 1.3.5 - 'mod_copy' Command Execution (Metasploit)
  7. MAY 25, 2021
    Exploit-DB entry: ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution (2)
  8. Attack activity. OCT 7, 2026
    ProFTPD Improper Access Control Vulnerability
  9. NOV 6, 2026
    CVE-2015-3306 discussed publicly (CIRCL sighting) (4 reports, latest NOV 9)

SOURCES

  1. [1] nuclei-templates: Nuclei scan template: ProFTPd - Remote Code Execution, OCT 24
  2. [2] CIRCL Vulnerability-Lookup sightings: CVE-2015-3306 discussed publicly (CIRCL sighting), NOV 9
  3. [3] CISA Known Exploited Vulnerabilities: ProFTPD Improper Access Control Vulnerability, OCT 7
  4. [4] Exploit-DB: Exploit-DB entry: ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution (2), MAY 25
  5. [5] Exploit-DB: Exploit-DB entry: ProFTPd 1.3.5 - 'mod_copy' Command Execution (Metasploit), JUN 9
  6. [6] CVE List V5 and CISA Vulnrichment: CISA Vulnrichment marks CVE-2015-3306 as actively exploited, MAY 18
  7. [7] Metasploit module metadata: Metasploit exploit module: ProFTPD 1.3.5 Mod_Copy Command Execution, APR 21
  8. [8] PoC-in-GitHub: 18 public GitHub repositories claim a proof of concept for CVE-2015-3306, APR 21
  9. [9] Exploit-DB: Exploit-DB entry: ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution, APR 20
  10. [10] CIRCL Vulnerability-Lookup sightings: 3 more reports
  11. [11] Exploit-DB: 1 more reports