CVE-2026-104102 in copyparty
Summary
by MITRE • 10/12/2026
copyparty is a portable file server. Prior to 1.20.19, FTP upload path handling does not confine destinations to configured copyparty volumes. When FTP or FTPS is explicitly enabled, a low-privileged authenticated user can submit traversal paths during upload to create a new file outside configured volumes wherever the copyparty process has write permission. The attacker cannot read or overwrite files, the output name receives a randomized suffix, and copyparty does not execute the file; however, unrelated software on the same host could process the newly created file. This issue is fixed in version 1.20.19.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in copyparty versions prior to 1.20.19 represents a significant path traversal flaw within its FTP and FTPS upload mechanisms, classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. This security defect arises from insufficient validation of user-supplied input during the file upload process, allowing an authenticated attacker with low privileges to manipulate destination paths beyond the intended scope of configured copyparty volumes. The core technical failure lies in the server's inability to properly confine uploaded files to their designated directories when FTP or FTPS protocols are explicitly enabled. By submitting carefully crafted traversal sequences such as dot-dot-slash patterns, a malicious actor can redirect file creation operations to arbitrary locations on the host system where the copyparty process possesses write permissions. This behavior aligns with ATT&CK technique T1083: File and Directory Discovery, although in this context it is leveraged for unauthorized file placement rather than mere reconnaissance.
The operational impact of this vulnerability is nuanced due to several mitigating factors inherent in the application's design. While an attacker can successfully create new files outside the restricted volumes, they are strictly limited to write operations; reading or overwriting existing files remains impossible. Furthermore, copyparty applies a randomized suffix to output filenames, which complicates predictability for subsequent exploitation steps such as file inclusion attacks that rely on known paths. Additionally, the application does not execute uploaded files directly, thereby preventing immediate code execution through this vector alone. However, the risk is amplified by the potential for secondary impacts involving unrelated software running on the same host system. If other services monitor specific directories or process newly created files based on naming conventions or location, an attacker could potentially trigger unintended actions within those external applications, leading to broader system compromise or denial of service conditions through resource exhaustion or malicious payload delivery via side-channel interactions.
To mitigate this vulnerability and secure copyparty deployments, it is imperative to upgrade immediately to version 1.20.19 or later, where the path handling logic has been corrected to strictly enforce volume boundaries regardless of input manipulation attempts. Administrators should also ensure that FTP and FTPS services are only enabled when absolutely necessary, as disabling these protocols eliminates this specific attack surface entirely. In environments where legacy protocol support is required, implementing strict chroot jails or containerization for the copyparty process can provide an additional layer of isolation, ensuring that even if path traversal occurs within the application logic, the operating system prevents access to sensitive areas outside the designated sandbox. Regular auditing of file permissions and monitoring for unexpected file creations in non-standard directories further aids in detecting potential exploitation attempts before they result in significant damage.