CVE-2015-3306 ProFTPD Improper Access Control

What is CVE-2015-3306?

CVE-2015-3306 is a critical path traversal vulnerability in Debian Debian Linux, published on 18 May 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

Weakness: CWE-284

Which versions are affected by CVE-2015-3306?

It affects 5 products.

Products include Debian Debian Linux, Fedoraproject Fedora, Opensuse Tumbleweed, Proftpd Proftpd, Suse Linux Enterprise Server.

How do I fix CVE-2015-3306?

Apply the vendor's patch. US federal agencies must fix it by 11 Oct 2026.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2015-3306 being exploited?

Yes. Attackers have exploited CVE-2015-3306 in the wild since at least 8 Oct 2026.

Public exploit code: 1 Metasploit module, 4 Exploit-DB entries, 1 Nuclei template and 18 proofs of concept on GitHub.

Other vulnerabilities in Debian Debian Linux

• CVE-2025-49113 RoundCube Webmail Deserialization of Untrusted Data Exploited Critical 9.9
• CVE-2026-24061 GNU InetUtils Argument Injection Exploited Critical 9.8
• CVE-2025-39682 Linux Kernel Improper Check for Unusual or Exceptional Conditions Exploited Critical 9.8
• CVE-2024-9680 Mozilla Firefox Use-After-Free Exploited Critical 9.8
• CVE-2022-30333 RARLAB UnRAR Directory Traversal Exploited Critical 9.8

All Debian Debian Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2015-3306, DSA-3263-1, GHSA-4mfj-5wr8-x32q, UBUNTU-CVE-2015-3306.