A file-copy feature on ProFTPD can give a remote attacker access to files far beyond the intended FTP transfer. On October 8, CISA listed CVE-2015-3306 as exploited and set October 11 as its action date. Operators with reachable ProFTPD services should treat this as an active patch-and-exposure job, including servers that handle routine transfers for other business systems.
The defect sits in mod_copy. The CVE Program’s description names ProFTPD 1.3.5; CISA says remote attackers can read and write arbitrary files through SITE CPFR and SITE CPTO. A service used for ordinary file transfers can therefore reach host files outside the expected transfer area. That puts server-held data and the files used by downstream jobs at risk.
File-copy commands cross their scope
SITE CPFR and SITE CPTO are the commands named in the vulnerability description. Their pairing belongs to ProFTPD’s file-copy feature; the failure is access control over which files a remote client can read or write. NIST’s NVD record describes the same arbitrary-file consequence for mod_copy in 1.3.5 and assesses exploitation as requiring no privileges or user interaction. That assessment makes an internet-reachable FTP endpoint a high-priority exposure, while internal endpoints still matter if an untrusted or compromised client can reach them.
CISA’s wording is direct: attackers could “read and write to arbitrary files via the site cpfr and site cpto commands.” Arbitrary write access can alter a server’s working files; the documented consequence here is file access, so assess any suspected follow-on execution against host evidence rather than assuming it occurred. The flaw dates to 2015; CISA’s October 2026 exploitation listing gives administrators a fresh reason to revisit servers that have quietly kept running.
Start with reachable FTP services
Inventory hosts running ProFTPD, including appliances and images that bundle it, and identify which clients can reach their FTP service. Check the deployed package or build against your distribution’s or vendor’s CVE-2015-3306 advisory. The upstream CVE names 1.3.5; packaged builds can carry backported fixes, so use the installed package’s security status instead of treating a version-string comparison as a patch test. CISA calls for vendor-aligned mitigations, internet-exposure assessment and forensic triage. If a mitigation is unavailable, its KEV entry directs organizations to discontinue use of the affected product under applicable guidance.
For services that must stay online while fixes are applied, limit FTP reachability to the clients and transfer paths that need it; remove public exposure where the service does not require it. This reduces who can reach the vulnerable command path. Then look at retained FTP command or session logs for SITE CPFR and SITE CPTO, especially unexpected client addresses, unusual times and file paths outside the expected transfer area. Compare any suspicious session with host file timestamps and integrity records for the paths involved. A command name in a log is a triage lead; file changes and session context determine what happened on that host. Logging configurations vary, so verify whether your server actually records these commands before relying on the search.
Verify fixes against each deployment
Apply the vendor or distribution’s security update or mitigation for CVE-2015-3306, and record the installed build and advisory that confirms the fix for each exposed host. Retest network reachability from an unauthorized client segment: the FTP service should be inaccessible from that segment, while approved transfer clients still work. Review the logs and affected file paths on any host with suspicious command activity before returning it to normal service. The check pairs a patch decision with an actual access boundary; an updated package alone does not tell you who can still talk to the server.
A workable first pass is to find ProFTPD where clients can reach it, confirm the package’s CVE-2015-3306 fix with its maintainer, and restrict FTP access to intended clients. On systems with command logs, use the named SITE CPFR and SITE CPTO operations to focus file-integrity review. CISA’s October 11 date makes that inventory and patch decision immediate; the way to verify your local containment is to test the service from a client network that should have no FTP access.