CVE-2015-3306
KEVCRITICAL 10.0EPSS 99.5%
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
- CVSS v3.1 CNA
- 10.0 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - CVSS v2.0 NVD
- 10.0 HIGH
AV:N/AC:L/Au:N/C:C/I:C/A:C - EPSS
- 99.50% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2026-10-08
- Nuclei
- critical · CWE-284
- Published
- 2015-05-18
- Updated
- 2026-10-09
Proof-of-concept exploits (21)
- http://packetstormsecurity.com/files/131567/ProFTPd-CPFR-CPTO-Proof-Of-Concept.html
- http://www.rapid7.com/db/modules/exploit/unix/ftp/proftpd_modcopy_exec
- 0xm4ud/ProFTPD_CVE-2015-33061★ · 2021-06-07
- JoseLRC97/ProFTPd-1.3.5-mod_copy-Remote-Command-Execution0★ · 2024-04-18
- RodrigoDominguezJimenez/exploitsRDJ0★ · 2024-11-20
- Sampad-Adhikary/qwc4f0★ · 2024-09-23
- Z3R0-0x30/CVE-2015-33060★ · 2025-05-14
- ardiadrianadri/js-exploits1★ · 2026-02-25
- cd6629/CVE-2015-3306-Python-PoC1★ · 2020-12-24
- cdedmondson/Modified-CVE-2015-3306-Exploit0★ · 2020-05-15
- cved-sources/cve-2015-33060★ · 2021-04-15
- davidtavarez/CVE-2015-33061★ · 2017-07-29
- donmedfor/CVE-2015-33060★ · 2025-08-23
- hackarada/cve-2015-33060★ · 2023-09-20
- jptr218/proftpd_bypass1★ · 2021-08-21
- m4udSec/ProFTPD_CVE-2015-33061★ · 2021-06-07
- shk0x/cpx_proftpd1★ · 2015-04-22
- t0kx/exploit-CVE-2015-3306152★ · 2018-04-07
- Z3R0space/CVE-2015-33060★ · 2025-05-14
- xyk0x/cpx_proftpd1★ · 2015-04-22
- diegslva/cve-2015-3306-lab0★ · 2026-09-07
Nuclei templates (1)
Metasploit modules (1)
ExploitDB entries (4)
- https://www.exploit-db.com/exploits/49908
- https://www.exploit-db.com/exploits/37262
- https://www.exploit-db.com/exploits/36742
- https://www.exploit-db.com/exploits/36803
Security advisories
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157053.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157054.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157581.html
- http://lists.opensuse.org/opensuse-updates/2015-06/msg00020.html
- http://packetstormsecurity.com/files/131505/ProFTPd-1.3.5-File-Copy.html
- http://packetstormsecurity.com/files/131555/ProFTPd-1.3.5-Remote-Command-Execution.html
- http://www.debian.org/security/2015/dsa-3263
- http://www.securityfocus.com/bid/74238