ProFTPD mod_copy is eleven years old and back on the exploited list

ProFTPD's mod_copy is eleven years old and back on the exploited list On 8 October 2026, CISA added CVE-2015-3306 to the Known Exploited Vulnerabilities catalog. The vulnerability was published in May 2015. That gap, eleven years, is the story worth telling, because nothing about the flaw itself changed in that time. The flaw in one paragraph ProFTPD 1.3.5 shipped a module called mod_copy that exposes two FTP commands, SITE CPFR and SITE CPTO, for copying a file from one path to another on the server. The commands require no authentication in the affected configuration, and they do not restrict the source or destination to the user's home directory. NVD's description is blunt: remote attackers can read and write arbitrary files via the site cpfr and site cpto commands. The CVSS 3.1 base score is 10.0, with a changed scope vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The exploitation pattern that made this famous is indirect. An attacker copies a file the attacker already controls, or a file the server will serve, into a path the web server executes. mod_copy alone gives file copy. Combined with a web root on the same host, it gives code execution. Why an old CVE returns to the catalog KEV additions are supposed to reflect observed exploitation in the wild, not theoretical severity. When a 2015 entry appears in October 2026, the most probable explanations are that an internet-wide scanning and exploitation campaign found a population that never patched, or that an intrusion set found the primitive useful against a specific target. An unpatched ProFTPD 1.3.5 in 2026 is not as rare as it should be. Distribution packages froze the module long ago, but appliances, container images, and bespoke builds derived from that era persist. A file-copy primitive on an FTP server that shares storage with a web application is exactly the kind of dependency that survives migrations because nobody remembers it is load-bearing. What the version numbers do not tell you NVD names ProFTPD 1.3.5. Later releases either removed mod_copy or restricted it, but the exact behaviour depends on the build and on whether the module is loaded at all. A binary reporting 1.3.5 is vulnerable only if mod_copy is compiled in and active, and a binary reporting a later version may still carry a patched-then-reverted module. Version-string checking alone will produce both false positives and false negatives here. The reliable test is functional, run in a lab against your own image: connect anonymously or without credentials if permitted, and attempt SITE CPFR against a harmless test file. If the server answers with a copy confirmation rather than an authentication error or an unknown-command error, the primitive is present. The harder inventory question is reachability. An FTP server on a management VLAN with no route from the internet is a different risk from one answering on port 21 to the world. Both may appear identical in a spreadsheet. Defensive actions, in order of cost First, find every ProFTPD instance you own, including the ones inside appliances and container base images, and determine whether mod_copy is loaded. LoadModule lines in proftpd.conf and the compiled-in module list both matter. Second, if the instance cannot be upgraded this week, disable the module. Removing mod_copy from the configuration is a smaller change than a package upgrade and removes the primitive entirely. The FTP service can continue to serve files without copy support. Third, and this is where most teams stop too early, ask what an arbitrary file write on that host could reach. A copy into a CGI directory, a scheduled task, or an SSH authorized_keys path converts a file operation into execution or persistence. The blast radius is a property of the host, not of the FTP daemon. Fourth, review logs for SITE CPFR and SITE CPTO usage. Most FTP servers log these commands, and most log retention policies keep them for ninety days or less. If you need evidence from before that window, it is already gone. The part that keeps repeating The KEV catalog is increasingly a list of old bugs rediscovered. That is not a failure of the catalog. It is a measurement of how long unfixed code survives in production, and of how confidently organisations assume a 2015 advisory stopped mattering. CVE-2015-3306 was never subtle, never hard to exploit, and never rare in affected deployments. It was simply quiet, and quiet is what a file-copy primitive looks like until someone reads your web root. References NIST NVD record for CVE-2015-3306, https://nvd.nist.gov/vuln/detail/CVE-2015-3306 CISA Known Exploited Vulnerabilities catalog entry, https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3306 ProFTPD project documentation, http://www.proftpd.org/