Vulnerability record · CVE-2019-12815 · published 19 July 2019
CVE-2019-12815: ProFTPD mod_copy arbitrary file copy enables unauthenticated RCE
PProftpd · Proftpd
mod_copy in ProFTPD up to 1.3.5b performs an arbitrary file copy without validating the source or destination, letting an unauthenticated remote client move attacker-controlled content into a location the server will execute or serve. It is a related issue to CVE-2015-3306 and matters because it turns a plain FTP service into an unauthenticated code execution path.
Description
An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a related issue to CVE-2015-3306.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityUnauthenticated network-reachable remote code execution with a CVSS of 9.8 and high EPSS probability, though not in KEV.
What it is
mod_copy in ProFTPD up to 1.3.5b performs an arbitrary file copy without validating the source or destination, letting an unauthenticated remote client move attacker-controlled content into a location the server will execute or serve. It is a related issue to CVE-2015-3306 and matters because it turns a plain FTP service into an unauthenticated code execution path.
Impact
An attacker gains remote code execution in the context of the ProFTPD process and can read files the service account can access, exposing credentials and configuration.
Attack surface
Reachable over the network through the FTP service when mod_copy is loaded and the SITE CPFR/SITE CPTO commands are available. The CVSS vector shows no privileges and no user interaction required.
Exploitation
Not listed in CISA KEV, but EPSS is 0.576 (99th percentile) and vendor and third-party references carry Exploit and Patch tags, indicating public exploit material exists.
What to do
- Upgrade ProFTPD to a version above 1.3.5b that contains the mod_copy fix, or apply the vendor patch referenced in the ProFTPD bug and pull request.
- If mod_copy is not needed, remove or disable the module and block SITE CPFR and SITE CPTO commands.
- Restrict FTP exposure to trusted networks and require TLS and authentication where the service must remain reachable.
- Update distribution packages (Debian, Fedora, Gentoo, openSUSE) and Siemens SIMATIC CP 1543-1 firmware to the fixed builds.
- Run the ProFTPD process under a least-privilege account with a restricted filesystem view.
Detection
- Alert on SITE CPFR and SITE CPTO commands in FTP logs or network traffic, especially from unauthenticated sessions.
- Monitor for new or modified files in web roots, FTP home directories and other writable paths owned by the ProFTPD account.
- Watch for ProFTPD spawning child processes or making outbound connections, which is abnormal for a file transfer daemon.
- Audit ProFTPD configuration and loaded modules to confirm whether mod_copy is present.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2019-12815 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2019-12815), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
