ProFTPD 1.3.5: critical CVE-2015-3306 now exploited

What it is and who is affectedCVE-2015-3306 is an improper access control flaw (CWE-284) in ProFTPD, tracked by the NVD as affecting ProFTPD 1.3.5 thr...

What it is and who is affected

CVE-2015-3306 is an improper access control flaw (CWE-284) in ProFTPD, tracked by the NVD as affecting ProFTPD 1.3.5 through its mod_copy module. According to the NVD description, remote attackers can read and write to arbitrary files by abusing the site cpfr and site cpto commands. In plain terms: a file-copy feature that should stay within the server's own boundaries can be pointed at files it was never meant to touch.

The severity is CVSS 3.1 score of 10 — critical (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). No authentication, no user interaction and no local access are required, and the impact spans confidentiality, integrity and availability beyond the vulnerable component itself. The flaw was published in the NVD on 18 May 2015, which makes it a decade-old issue that is still worth checking for.

Beyond the ProFTPD package itself, the NVD lists distributions that shipped the affected code: Fedora 20, 21 and 22; Debian Linux 7.0, 8.0 and 9.0; openSUSE Tumbleweed; and SUSE Linux Enterprise Server 15 SP7. If any of those systems still run an unpatched ProFTPD build, they fall inside the affected scope.

Why it is urgent now

This is not a theoretical bug sitting in a database. CISA added CVE-2015-3306 to its Known Exploited Vulnerabilities (KEV) catalogue on 8 October 2026, which means there is confirmed evidence of exploitation in real attacks. For US federal agencies, CISA set a remediation deadline of 11 October 2026 — only three days later — and asked them to apply mitigations following vendor instructions, assess each asset's internet exposure and, where no mitigation exists, discontinue use of the product.

The material does not record this CVE as used in ransomware campaigns, so the immediate risk is unauthorised file access rather than a confirmed ransomware chain. That distinction matters, but it does not soften the problem: arbitrary file read and write on a server is exactly the kind of foothold an intruder uses to plant a web shell, alter configuration or reach credentials. The short CISA window is a clear signal that exposed instances should not wait.

What to do today

Find out whether you run ProFTPD. Check FTP services on your own servers, on VPS instances and on any legacy machine still in production. Confirm the exact version; the NVD entry centres on 1.3.5, and distributions in the list above may ship it as a package.
Apply the fix or mitigation from the vendor advisory. The material does not specify a corrected version, so follow the ProFTPD project's guidance and your distribution's security notice rather than guessing. If the mod_copy module is not needed, removing or disabling it reduces exposure — but confirm this against the vendor's instructions first.
Look for signs of intrusion. Review FTP logs for unusual use of the site cpfr and site cpto commands, unexpected file changes in web roots and configuration directories, and new or modified files you cannot account for. Preserve logs before cleaning anything.
Shrink what the internet can see. FTP rarely needs to be open to the whole world. Restrict access by IP where possible, move transfers to SFTP or a VPN, and close any instance that is no longer in use.
Check the rest of the stack. An FTP service on the same host as a WordPress, PrestaShop or Joomla site widens the blast radius. Patch the CMS and its plugins on the same schedule.

How a cybersecurity team like ALMC's can help

For a small business or an online shop with a lean IT team, the hard part is rarely reading the advisory — it is knowing what is actually running, and in which version. ALMC's cybersecurity work starts with a security audit and pentesting to map exposed services and vulnerabilities across servers and web platforms, followed by hardening to remove features and permissions that are not needed, such as an FTP module nobody uses.

From there, monitoring and incident response cover the detection side: spotting unusual file activity or suspicious commands before they turn into a defaced shop or a data breach. For companies on WordPress, PrestaShop or Joomla, ongoing maintenance and updates keep the CMS and its extensions patched, and if a site has already been hacked, the team handles recovery and cleanup. The goal is simple: close the gaps before someone else finds them, and keep a record that satisfies GDPR obligations if personal data is ever at risk.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.