CVE-2026-93353 Details
Description
copyparty contains a volume restriction bypass vulnerability in its SFTP front end that allows authenticated SFTP users to create, remove, and truncate arbitrary paths outside permitted volume boundaries by exploiting three handlers that bypass the xvol volflag enforcement. The _mkdir, _rmdir, and _chattr handlers construct destination paths using vfs.get(), vn.canonical(), and os.path.join() without invoking the chk_ap access check, enabling attackers to traverse symlinks leaving a volume's top directory and perform unauthorized file creation, deletion, or truncation via SSH_FXP_SETSTAT operations on paths outside any volume the account is authorized to access.
A vulnerability has been identified in Copyparty's SFTP implementation, allowing authenticated users to bypass volume restrictions. This issue arises in versions of Copyparty through 1.20.24, where the SFTP front end fails to properly enforce volume boundaries. The vulnerability enables users to create, delete, and truncate files outside their authorized volume by exploiting three SFTP handlers: '_mkdir', '_rmdir', and '_chattr'. These handlers construct destination paths without performing the necessary access checks, allowing unauthorized file operations via SSH_FXP_SETSTAT commands on paths beyond the user's permitted volume.
As of the current release, no official fix has been provided for this vulnerability. However, users can manually avoid the affected SFTP handlers or monitor for future updates from the Copyparty maintainer.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-424 | Improper Protection of Alternate Path | [email protected] |
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| copyparty | <= 1.20.24 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | New CVE Received | [email protected] |