CVE-2026-93353: copyparty SFTP Path Traversal Vulnerability

CVE-2026-93353 Overview

CVE-2026-93353 is a volume restriction bypass vulnerability in copyparty's SFTP front end. Authenticated SFTP users can create, remove, and truncate arbitrary paths outside permitted volume boundaries. The flaw exists in three handlers (_mkdir, _rmdir, and _chattr) that construct destination paths using vfs.get(), vn.canonical(), and os.path.join() without invoking the chk_ap access check. Attackers can traverse symlinks that leave a volume's top directory and perform unauthorized file operations via SSH_FXP_SETSTAT on paths outside any authorized volume. The vulnerability is categorized under [CWE-59] (Improper Link Resolution Before File Access, also known as a symlink attack).

Critical Impact
Authenticated SFTP users can escape volume boundaries through symlink traversal to create, delete, or truncate files anywhere the copyparty process has filesystem access.

Affected Products

copyparty file server
copyparty SFTP front end (_mkdir, _rmdir, _chattr handlers)
Deployments exposing SFTP access with symlink-containing volumes

Discovery Timeline

2026-09-24 - CVE-2026-93353 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-93353

Vulnerability Analysis

The vulnerability resides in copyparty's SFTP front end, which exposes directory and file metadata operations over SSH. Three handler functions construct target paths through the virtual filesystem layer but omit the chk_ap access check that enforces the xvol volflag. The xvol volflag is intended to confine users within their assigned volume boundaries by blocking symlink traversal outside the volume root.

Without the chk_ap call, the handlers resolve canonical paths and operate on them directly. An authenticated SFTP user who can reach a symlink within an assigned volume can follow that symlink to any location the copyparty process can access. The bypass affects three distinct operation classes: directory creation, directory removal, and attribute modification through SSH_FXP_SETSTAT.

Exploitation requires valid SFTP credentials and the presence of a symlink that leads outside the user's authorized volume. The attack surface is limited to the operations exposed by the affected handlers rather than arbitrary read access, but the ability to truncate or delete files outside the volume can corrupt unrelated application state.

Root Cause

The root cause is a missing authorization check at three specific call sites. Path construction uses vfs.get() followed by vn.canonical() and os.path.join(), but the resulting canonical path is never validated against the volume boundary. Other SFTP handlers in copyparty call chk_ap to confirm the resolved path remains within the authorized volume. The three affected handlers skip this step, treating any resolvable canonical path as a legitimate target.

Attack Vector

An authenticated attacker connects to the copyparty SFTP service with low-privilege credentials. The attacker identifies or plants a symlink inside an authorized volume that points outside the volume root. Issuing MKDIR, RMDIR, or SETSTAT requests against paths traversing that symlink causes the handler to resolve the canonical destination and perform the operation without enforcing the xvol restriction. The result is arbitrary directory creation, directory removal, or file truncation outside volume boundaries. Technical details are documented in the Euricon Icaico CVE Analysis and the VulnCheck Advisory on CopyParty.

Detection Methods for CVE-2026-93353

Indicators of Compromise

Unexpected directory creation or removal events on paths outside configured copyparty volume roots performed by the copyparty service account.
File truncation events (size changed to zero) on sensitive files owned by or accessible to the copyparty process.
SFTP session logs showing SSH_FXP_MKDIR, SSH_FXP_RMDIR, or SSH_FXP_SETSTAT requests referencing paths containing .. segments or known symlink names.
Symlinks within copyparty volumes whose targets resolve outside the volume root.

Detection Strategies

Audit the copyparty configuration for volumes containing symlinks and inventory any symlink targets pointing outside the volume boundary.
Enable filesystem auditing (auditd on Linux) on directories adjacent to copyparty volumes to capture writes by the copyparty service account.
Correlate SFTP authentication events with filesystem change events to identify operations that occur outside the expected volume scope.

Monitoring Recommendations

Forward copyparty access logs and host-level file integrity monitoring events to a centralized logging platform for correlation.
Alert on any SETSTAT operation that modifies file size to zero on hosts running copyparty.
Monitor for creation of new symlinks inside copyparty volumes, especially symlinks with targets outside the volume root.

How to Mitigate CVE-2026-93353

Immediate Actions Required

Upgrade copyparty to a version containing the fix that adds chk_ap enforcement to the _mkdir, _rmdir, and _chattr handlers.
Disable the SFTP front end if a patched version is not yet available and SFTP is not required.
Remove or audit symlinks inside copyparty volumes whose targets fall outside the volume root.
Rotate credentials for any SFTP accounts that may have been used to exercise the bypass.

Patch Information

Refer to the VulnCheck Advisory on CopyParty for the fixed version information and upstream patch references. The fix adds the missing chk_ap access check to the three affected handler call sites so that canonical paths are validated against the xvol volflag boundary before file operations execute.

Workarounds

Disable SFTP access in the copyparty configuration until the patch is applied.
Restrict SFTP access to trusted authenticated users only, using network-level ACLs to limit exposure.
Remove symlinks from all copyparty-managed volumes to eliminate the traversal primitive.
Run copyparty as a dedicated unprivileged user with filesystem permissions limited strictly to configured volume paths.

bash

# Example: run copyparty with SFTP disabled until patched
copyparty -v /srv/share:share:r,w --no-sftp

# Example: audit volume directories for outbound symlinks
find /srv/share -type l -exec sh -c 'readlink -f "$1" | grep -qv "^/srv/share/" && echo "OUT-OF-VOLUME: $1"' _ {} \;