How does the ProFTPD file copy flaw bypass access controls?

The short version

• ProFTPD contains an improper access control vulnerability in the mod_copy module.
• Attackers can use site cpfr and site cpto commands to manipulate files.
• The US Cybersecurity and Infrastructure Security Agency set a strict deadline for federal systems.

The details

The vulnerability, tracked as CVE-2015-3306, resides in version 1.3.5 of the ProFTPD server software. According to the National Vulnerability Database, the issue stems from the mod_copy module. This component permits remote attackers to read from and write to arbitrary files on the affected system. The exploitation vector relies on the FTP commands site cpfr and site cpto, which are designed for copying files but lack sufficient access control checks in this configuration.

The Common Vulnerability Scoring System rates the severity at 10.0, classifying it as critical. The underlying weaknesses are mapped to CWE-284, indicating improper access control. The flaw allows an unauthenticated or authenticated remote attacker to bypass intended restrictions, potentially leading to full system compromise depending on the permissions of the FTP service account.

The context

The US Cybersecurity and Infrastructure Security Agency added this CVE to its Known Exploited Vulnerabilities catalog on 8 October 2026. According to The Hacker News, this addition follows confirmed abuse by a China-linked threat actor known as Flax Typhoon. The group has exploited this specific flaw alongside four other vulnerabilities to target organisations.

CISA requires all federal civilian executive branch agencies to apply mitigations by 11 October 2026. This mandate aligns with Binding Operational Directive 26-04, which prioritises security updates based on risk. Agencies must evaluate the internet exposure of each asset running ProFTPD. If vendor mitigations are unavailable, the guidance instructs stakeholders to discontinue use of the product or follow specific cloud service protocols.

Next steps

Organisations should immediately inventory all systems running ProFTPD 1.3.5 or earlier. Security teams must verify whether the mod_copy module is enabled. If enabled, administrators should disable it or upgrade to a patched version that resolves the access control logic. Federal entities must document compliance with the 11 October deadline to avoid regulatory penalties.

Background: Threat actors

Threat actors are individuals or groups who initiate cyber attacks. They range from lone hackers to state-sponsored organisations. Understanding their motives helps you predict behaviour. You must monitor for anomalies, not just known signatures, to detect their presence before data exfiltration occurs.

Read the full guide: What Is Threat Actors: Definitions, Tactics and Detection Strategies

What to do and how to stay safe: ProFTPD

• Audit FTP servers to identify instances of ProFTPD 1.3.5 or older versions.
• Disable the mod_copy module if upgrading is not immediately possible.
• Restrict FTP access to trusted networks only using firewall rules.
• Monitor logs for unusual site cpfr or site cpto command usage.

Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection

General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the deadline for federal agencies to patch this flaw?

Federal agencies must apply mitigations by 11 October 2026.

Which commands exploit this vulnerability?

Attackers use the site cpfr and site cpto FTP commands to exploit the flaw.

Is this vulnerability linked to a specific threat actor?

Yes, CISA added it to the KEV catalog after abuse by Flax Typhoon.