CVE-2026-104102: copyparty FTP Path Traversal Vulnerability

CVE-2026-104102 Overview

CVE-2026-104102 is a path traversal vulnerability [CWE-22] in copyparty, a portable file server written in Python. Versions prior to 1.20.19 fail to confine FTP upload destinations to configured copyparty volumes. When FTP or FTPS is explicitly enabled, a low-privileged authenticated user can submit traversal paths during upload. This allows the attacker to create files outside configured volumes anywhere the copyparty process has write permission.

Critical Impact
An authenticated FTP user can write new files outside configured volumes to any location where the copyparty process has write access, potentially enabling indirect code execution through unrelated host software.

Affected Products

copyparty versions prior to 1.20.19
Deployments with FTP enabled
Deployments with FTPS enabled

Discovery Timeline

2026-10-12 - CVE-2026-104102 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-104102

Vulnerability Analysis

The vulnerability resides in copyparty's FTP server implementation, specifically in how upload paths are validated against configured volume boundaries. The FTP service accepts upload commands containing directory traversal sequences without enforcing that the resolved destination remains inside a configured volume.

An authenticated low-privileged user can issue an FTP STOR or STOU command with a path containing traversal characters. The server resolves the path and writes the uploaded content wherever the copyparty process has filesystem write permission. The attacker cannot read existing files or overwrite them, and the output filename receives a randomized suffix. copyparty itself does not execute the file.

The impact becomes material when unrelated software on the same host processes files from the written location. Common examples include log parsers, cron-driven file watchers, backup agents, or web servers serving static content.

Root Cause

The FTP file system abstraction class in copyparty/ftpd.py exposed a mkstemp code path through the STOU (store unique) command that bypassed the volume confinement checks applied to normal uploads. Because mkstemp was handled directly by the underlying pyftpdlib library without volume validation, destinations resolved outside configured volumes were accepted.

Attack Vector

Exploitation requires network access to the FTP or FTPS service and valid low-privileged credentials. The attacker connects to the FTP service and issues a store-unique command with a traversal path targeting a location outside configured volumes.

python

     def get_group_by_uid(self, gid: int) -> str:
         return "root"
 
+    def mkstemp(self, *a, **ka):
+        self.log("mkstemp%r @%s" % (a, self.uname))
+        raise FSE("nope")
+
 
 class FtpHandler(FTPHandler):
     abstracted_fs = FtpFs

Source: GitHub Commit b331bb1c

The patch overrides mkstemp on the FTP filesystem class to log the attempt and raise a filesystem error, blocking the STOU path that bypassed volume confinement.

Detection Methods for CVE-2026-104102

Indicators of Compromise

FTP server log entries containing mkstemp calls, which the patched version explicitly logs with the username context.
Unexpected files appearing outside configured copyparty volumes but within directories writable by the copyparty service account.
FTP STOU commands originating from low-privileged authenticated sessions.
New files on the host containing randomized suffixes in paths not managed by copyparty.

Detection Strategies

Audit FTP access logs for upload commands containing ../ sequences or absolute paths outside declared volumes.
Monitor filesystem write activity by the copyparty process to directories outside its configured volume roots.
Compare the installed copyparty version against 1.20.19 across all hosts exposing FTP or FTPS.

Monitoring Recommendations

Enable verbose FTP logging in copyparty to capture upload paths and authenticated usernames.
Forward copyparty logs to a central SIEM or data lake for pattern analysis across sessions.
Alert on any file creation by the copyparty process user outside the expected volume directories.

How to Mitigate CVE-2026-104102

Immediate Actions Required

Upgrade copyparty to version 1.20.19 or later on all hosts.
If upgrade is not immediately possible, disable the FTP and FTPS services in the copyparty configuration.
Review the copyparty process account's filesystem permissions and remove write access to any directory outside its required volumes.
Audit existing files in writable directories for unexpected uploads with randomized suffixes.

Patch Information

The fix is included in copyparty 1.20.19, released on GitHub. See the GitHub Release v1.20.19 and the GitHub Security Advisory GHSA-phv8-wgjp-g4p9 for full details. The patch is applied in GitHub Commit b331bb1c.

Workarounds

Disable FTP and FTPS protocols entirely if they are not required; the vulnerability only applies when FTP or FTPS is explicitly enabled.
Run the copyparty process under a dedicated unprivileged account with filesystem write access restricted to configured volume directories only.
Restrict network access to the FTP port using host firewall rules so only trusted clients can reach the service.

bash

# Upgrade copyparty via pip
python3 -m pip install --upgrade 'copyparty>=1.20.19'

# Or disable FTP in your copyparty invocation by removing
# the --ftp and --ftps flags from the service command line