CVE-2026-93353
published 2026-09-24CVE-2026-93353: copyparty contains a volume restriction bypass vulnerability in its SFTP front end that allows authenticated SFTP users to create, remove, and truncate…
PriorityP418low3.1CVSS 3.1
AVNACHPRLUINSUCNILAN
EPSS
0.27%
18.7th percentile
copyparty contains a volume restriction bypass vulnerability in its SFTP front end that allows authenticated SFTP users to create, remove, and truncate arbitrary paths outside permitted volume boundaries by exploiting three handlers that bypass the xvol volflag enforcement. The _mkdir, _rmdir, and _chattr handlers construct destination paths using vfs.get(), vn.canonical(), and os.path.join() without invoking the chk_ap access check, enabling attackers to traverse symlinks leaving a volume's top directory and perform unauthorized file creation, deletion, or truncation via SSH_FXP_SETSTAT operations on paths outside any volume the account is authorized to access.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| 9001 | copyparty | <= 1.20.24 | — |
CVSS provenance
nvdv3.13.1LOWCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
nvdv4.02.3LOWCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
copyparty up to 1.20.24 SFTP Front End _mkdir/_rmdir/_chattr path traversal
vuldb·2026-09-24·CVSS 5.3
CVE-2026-93353 [MEDIUM] copyparty up to 1.20.24 SFTP Front End _mkdir/_rmdir/_chattr path traversal
A vulnerability, which was classified as critical, has been found in copyparty up to 1.20.24. Affected by this issue is the function _mkdir/_rmdir/_chattr of the component SFTP Front End. This manipulation causes path traversal.
This vulnerability is registered as CVE-2026-93353. Remote exploitation of the attack is possible. No exploit is available.
GHSA
copyparty contains a volume restriction bypass vulnerability in its SFTP front end that allows authenticated SFTP users to create, remove, and truncate arbitrary paths outside permitted volume boundar
ghsa_unreviewed·2026-09-24
CVE-2026-93353 [MEDIUM] CWE-59 copyparty contains a volume restriction bypass vulnerability in its SFTP front end that allows authenticated SFTP users to create, remove, and truncate arbitrary paths outside permitted volume boundar
copyparty contains a volume restriction bypass vulnerability in its SFTP front end that allows authenticated SFTP users to create, remove, and truncate arbitrary paths outside permitted volume boundaries by exploiting three handlers that bypass the xvol volflag enforcement. The _mkdir, _rmdir, and _chattr handlers construct destination paths using vfs.get(), vn.canonical(), and os.path.join() without invoking the chk_ap access check, enabling attackers to traverse symlinks leaving a volume's top directory and perform unauthorized file creation, deletion, or truncation via SSH_FXP_SETSTAT operations on paths outside any volume the account is authorized to access.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-93353 copyparty: copyparty: Unauthorized file modification via SFTP volume restriction bypass [fedora-all]
bugzilla·2026-09-25·CVSS 3.1
CVE-2026-93353 [LOW] CVE-2026-93353 copyparty: copyparty: Unauthorized file modification via SFTP volume restriction bypass [fedora-all]
CVE-2026-93353 copyparty: copyparty: Unauthorized file modification via SFTP volume restriction bypass [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
copyparty contains a volume restriction bypass vulnerability in its SFTP front end that allows authenticated SFTP users to create, remove, and truncate arbitrary paths outside permitted volume boundaries by exploiting three handlers that bypass the xvol volflag enforcement. The _mkdir, _rmdir, and _chattr handlers construct destination paths using vfs.get(), vn.canonical(), and os.path.join() without invoking the chk_ap access check, enabling attackers t
Bugzilla
CVE-2026-93353 copyparty: copyparty: Unauthorized file modification via SFTP volume restriction bypass
bugzilla·2026-09-24·CVSS 3.1
CVE-2026-93353 [LOW] CVE-2026-93353 copyparty: copyparty: Unauthorized file modification via SFTP volume restriction bypass
CVE-2026-93353 copyparty: copyparty: Unauthorized file modification via SFTP volume restriction bypass
copyparty contains a volume restriction bypass vulnerability in its SFTP front end that allows authenticated SFTP users to create, remove, and truncate arbitrary paths outside permitted volume boundaries by exploiting three handlers that bypass the xvol volflag enforcement. The _mkdir, _rmdir, and _chattr handlers construct destination paths using vfs.get(), vn.canonical(), and os.path.join() without invoking the chk_ap access check, enabling attackers to traverse symlinks leaving a volume's top directory and perform unauthorized file creation, deletion, or truncation via SSH_FXP_SETSTAT operations on paths outside any volume the account is authorized to access.
2026-09-24
Published