CVE-2026-93353

Name of the Vulnerable Software and Affected Versions copyparty (affected versions not specified)

Description The SFTP front end contains a volume restriction bypass that allows authenticated users to create, remove, and truncate arbitrary paths outside permitted volume boundaries. This occurs because the mkdir, rmdir, and chattr handlers construct destination paths using vfs.get(), vn.canonical(), and os.path.join() without invoking the chk ap access check. Consequently, attackers can traverse symlinks to leave a volume's top directory and perform unauthorized file operations via SSH FXP SETSTAT operations on paths outside their authorized volumes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.