AI analysis
Claude Opus · 5 Nov 2026, 10:19 CET
ProFTPD 1.3.5 mod_copy flaw lets remote attackers read and write files
ProFTPD 1.3.5 with mod_copy lets unauthenticated remote attackers read and write arbitrary files. CISA confirms active exploitation. Update ProFTPD through your vendor or distribution, or disable mod_copy, and check exposed FTP servers for compromise.
In plain terms
ProFTPD is widely used software for running FTP servers, which let people transfer files over a network. Version 1.3.5 includes an optional component called mod_copy that adds commands for copying files on the server. Those copy commands do not properly check who is allowed to use them. As a result, someone on the internet with no account could copy files on the server, both reading data they should not see and placing files where they should not be.
This matters to anyone running ProFTPD 1.3.5, whether installed directly or through Linux distributions such as Debian, Fedora, openSUSE Tumbleweed or SUSE Linux Enterprise Server. The flaw was first published in 2015. In October 2026 the US Cybersecurity and Infrastructure Security Agency (CISA) added it to its catalog of vulnerabilities known to be exploited in real attacks, so forgotten or unpatched servers are a real concern.