CVE-2015-3306

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

CVSS 3.1

10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS

99% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-25)

CISA KEV

listed 2026-10-08, due 2026-10-11

CWE

CWE-284

Published

2015-05-18

Modified

2026-10-09

Record from

the NVD, synced 2026-10-19

Affected

• debian:debian_linux
• fedoraproject:fedora
• opensuse:tumbleweed
• proftpd:proftpd
• suse:linux_enterprise_server

References

• http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157053.html
• http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157054.html
• http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157581.html
• http://lists.opensuse.org/opensuse-updates/2015-06/msg00020.html
• http://packetstormsecurity.com/files/131505/ProFTPd-1.3.5-File-Copy.html

Check your stackJSON