CVE-2026-93353: Improper Link Resolution Before File Access ('Link Following') in 9001 copyparty
copyparty contains a volume restriction bypass vulnerability in its SFTP front end that allows authenticated SFTP users to create, remove, and truncate arbitrary paths outside permitted volume boundaries by exploiting three handlers that bypass the xvol volflag enforcement. The _mkdir, _rmdir, and _chattr handlers construct destination paths using vfs.get(), vn.canonical(), and os.path.join() without invoking the chk_ap access check, enabling attackers to traverse symlinks leaving a volume's top directory and perform unauthorized file creation, deletion, or truncation via SSH_FXP_SETSTAT operations on paths outside any volume the account is authorized to access.
AI Analysis
Technical Summary
The vulnerability in copyparty arises from improper link resolution before file access in its SFTP front end. Specifically, the _mkdir, _rmdir, and _chattr handlers construct destination paths using vfs.get(), vn.canonical(), and os.path.join() without invoking the chk_ap access check. This omission allows authenticated SFTP users to bypass volume boundary restrictions by traversing symlinks, enabling them to create, remove, or truncate arbitrary files outside their permitted volumes. The issue affects versions from 0 up to and including 1.20.24.
Potential Impact
Authenticated SFTP users with limited privileges can exploit this vulnerability to perform unauthorized file operations outside their assigned volume boundaries. This can lead to unauthorized file creation, deletion, or truncation, potentially impacting data integrity and system stability within the affected environment.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict SFTP user privileges and monitor for unusual file operations. Avoid granting unnecessary write permissions and consider disabling the vulnerable handlers if possible.
CVE-2026-93353: Improper Link Resolution Before File Access ('Link Following') in 9001 copyparty
Description
copyparty contains a volume restriction bypass vulnerability in its SFTP front end that allows authenticated SFTP users to create, remove, and truncate arbitrary paths outside permitted volume boundaries by exploiting three handlers that bypass the xvol volflag enforcement. The _mkdir, _rmdir, and _chattr handlers construct destination paths using vfs.get(), vn.canonical(), and os.path.join() without invoking the chk_ap access check, enabling attackers to traverse symlinks leaving a volume's top directory and perform unauthorized file creation, deletion, or truncation via SSH_FXP_SETSTAT operations on paths outside any volume the account is authorized to access.
CVSS v4.0
Score 6.0medium
Affected software
9001
copyparty
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in copyparty arises from improper link resolution before file access in its SFTP front end. Specifically, the _mkdir, _rmdir, and _chattr handlers construct destination paths using vfs.get(), vn.canonical(), and os.path.join() without invoking the chk_ap access check. This omission allows authenticated SFTP users to bypass volume boundary restrictions by traversing symlinks, enabling them to create, remove, or truncate arbitrary files outside their permitted volumes. The issue affects versions from 0 up to and including 1.20.24.
Potential Impact
Authenticated SFTP users with limited privileges can exploit this vulnerability to perform unauthorized file operations outside their assigned volume boundaries. This can lead to unauthorized file creation, deletion, or truncation, potentially impacting data integrity and system stability within the affected environment.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict SFTP user privileges and monitor for unusual file operations. Avoid granting unnecessary write permissions and consider disabling the vulnerable handlers if possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-17T18:41:40.757Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab59083f7a7c54106d840ef
Added to database: 09/24/2026, 21:05:07 UTC
Last enriched: 09/24/2026, 21:17:53 UTC
Last updated: 09/25/2026, 01:59:16 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.