Vulnerability · Published Sep 24, 2026 · Assigned by VulnCheck

CVE-2026-93353copyparty SFTP Volume Restriction Bypass via mkdir/rmdir/chattr Handlers

Low 3.1

In plain English

A low-severity security flaw in copyparty from 9001. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)3.1Low

Exploit odds (30 days)0.3%top 80.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

copyparty contains a volume restriction bypass vulnerability in its SFTP front end that allows authenticated SFTP users to create, remove, and truncate arbitrary paths outside permitted volume boundaries by exploiting three handlers that bypass the xvol volflag enforcement. The _mkdir, _rmdir, and _chattr handlers construct destination paths using vfs.get(), vn.canonical(), and os.path.join() without invoking the chk_ap access check, enabling attackers to traverse symlinks leaving a volume's top directory and perform unauthorized file creation, deletion, or truncation via SSH_FXP_SETSTAT operations on paths outside any volume the account is authorized to access.

Affected products (as reported)

Vendor	Product	Versions
9001	copyparty	0 – through 1.20.24

Weakness: CWE-59, CWE-424 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

References

Researcher Disclosure technical-description, exploit
https://www.vulncheck.com/advisories/copyparty-sftp-volume-restriction-bypass-via-mkdir-rmdir-chattr-handlers third-party-advisory