CVE-2026-104102

Published: Ott 12, 2026 Last Modified: Ott 12, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 5,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A

Description

AI Translation Available

copyparty is a portable file server. Prior to 1.20.19, FTP upload path handling does not confine destinations to configured copyparty volumes. When FTP or FTPS is explicitly enabled, a low-privileged authenticated user can submit traversal paths during upload to create a new file outside configured volumes wherever the copyparty process has write permission. The attacker cannot read or overwrite files, the output name receives a randomized suffix, and copyparty does not execute the file; however, unrelated software on the same host could process the newly created file. This issue is fixed in version 1.20.19.

22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Stable
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Confidentiality Availability
Potential Impacts:
Execute Unauthorized Code Or Commands Modify Files Or Directories Read Files Or Directories Dos: Crash, Exit, Or Restart
Applicable Platforms
Technologies: AI/ML
Likelihood of Exploit: High
View CWE Details
https://github.com/9001/copyparty/commit/b331bb1c8c8cc306b9…
https://github.com/9001/copyparty/commit/b331bb1c8c8cc306b91e4d94221969335a7a3e…
https://github.com/9001/copyparty/releases/tag/v1.20.19
https://github.com/9001/copyparty/releases/tag/v1.20.19
https://github.com/9001/copyparty/security/advisories/GHSA-…
https://github.com/9001/copyparty/security/advisories/GHSA-phv8-wgjp-g4p9