Volume Restriction Bypass in copyparty SFTP

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: VulnCheck

Description

copyparty contains a volume restriction bypass vulnerability in its SFTP front end that allows authenticated SFTP users to create, remove, and truncate arbitrary paths outside permitted volume boundaries by exploiting three handlers that bypass the xvol volflag enforcement. The _mkdir, _rmdir, and _chattr handlers construct destination paths using vfs.get(), vn.canonical(), and os.path.join() without invoking the chk_ap access check, enabling attackers to traverse symlinks leaving a volume's top directory and perform unauthorized file creation, deletion, or truncation via SSH_FXP_SETSTAT operations on paths outside any volume the account is authorized to access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-24

Generated

2026-09-25

AI Q&A

2026-09-25

EPSS Evaluated

N/A

NVD

CVE-2026-93353

Affected Vendors & Products

Vendor	Product	Version / Range
copyparty	copyparty	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-424	The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

Executive Summary

copyparty has a volume restriction bypass flaw in its SFTP interface. Authenticated SFTP users can exploit three handlers (_mkdir, _rmdir, _chattr) to create, delete, or truncate files outside allowed volume paths. These handlers bypass volume boundary checks by using path construction methods that do not enforce access restrictions, allowing attackers to traverse symlinks and perform unauthorized operations via SSH_FXP_SETSTAT commands.

Impact Analysis

If you use copyparty's SFTP feature, an attacker with valid credentials could delete or modify files outside your intended volume, potentially causing data loss or corruption. They could also create unauthorized files in restricted directories, leading to system instability or security breaches.

Mitigation Strategies

Update copyparty to the latest version that patches the volume restriction bypass vulnerability in the SFTP front end. Disable SFTP access if not required or restrict authenticated users to only permitted volume boundaries.

Hi! I’m here to help you understand CVE-2026-93353. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70