CVE-2026-93353copyparty SFTP Volume Restriction Bypass via mkdir/rmdir/chattr Handlers
Updated under an hour ago ()
Does this affect you?
It affects 9001 copyparty. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
copyparty contains a volume restriction bypass vulnerability in its SFTP front end that allows authenticated SFTP users to create, remove, and truncate arbitrary paths outside permitted volume boundaries by exploiting three handlers that bypass the xvol volflag enforcement. The _mkdir, _rmdir, and _chattr handlers construct destination paths using vfs.get(), vn.canonical(), and os.path.join() without invoking the chk_ap access check, enabling attackers to traverse symlinks leaving a volume's top directory and perform unauthorized file creation, deletion, or truncation via SSH_FXP_SETSTAT operations on paths outside any volume the account is authorized to access.
- CVSS
- 3.1 LOW (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness (CWE)
- CWE-59, CWE-424
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- VulnCheck
- NVD analysis
- Deferred
- Record last updated
- Oct 1, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
9001 copyparty 9001:copyparty (from the name) | through 1.20.24 | CNA record |
References
- https://euriconicacio.github.io/blog/cve-2026-93353-a-volume-guard-enforced-one-call-site-at-a-time/technical-description, exploit
- https://www.vulncheck.com/advisories/copyparty-sftp-volume-restriction-bypass-via-mkdir-rmdir-chattr-handlersthird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.