Read the docs
TI-2026-71225 Aliases CVE-2026-104102GHSA-phv8-wgjp-g4p9

Path traversal in copyparty FTP uploads creates files outside volumes

Priority LOW 24CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

copyparty before 1.20.19 does not confine FTP upload destinations to configured volumes, a path traversal flaw (CWE-22). When FTP or FTPS is explicitly enabled, a low-privileged authenticated user can submit traversal paths during upload to create a new file outside the configured volumes, wherever the copyparty process has write permission. The attacker cannot read or overwrite files, and copyparty does not execute the created file, but other software on the same host could process it.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

copyparty is a portable file server. Prior to 1.20.19, FTP upload path handling does not confine destinations to configured copyparty volumes. When FTP or FTPS is explicitly enabled, a low-privileged authenticated user can submit traversal paths during upload to create a new file outside configured volumes wherever the copyparty process has write permission. The attacker cannot read or overwrite files, the output name receives a randomized suffix, and copyparty does not execute the file; however, unrelated software on the same host could process the newly created file. This issue is fixed in version 1.20.19.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00313 24th percentileScored 2026-11-07
Fix Fixed copyparty (9001): 1.20.19copyparty (PyPI): 1.20.19

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
9001copypartybefore 1.20.191.20.19Patch availableCNA
—copyparty (PyPI)before 1.20.191.20.19Patch availableGHSA-phv8-wgjp-g4p9
  • copyparty Vendor9001 Affected before 1.20.19 Fixed in 1.20.19 Patch available CNA
  • copyparty (PyPI) Vendor— Affected before 1.20.19 Fixed in 1.20.19 Patch available GHSA-phv8-wgjp-g4p9

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:9001:copyparty:*:*:*:*:*:*:*:*——9001
  • cpe:2.3:a:9001:copyparty:*:*:*:*:*:*:*:* Versions — — ·9001

Remediation

Upgrade the PyPI copyparty package to version 1.20.19, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA copyparty (9001) Fixed in 1.20.19
  • Fix · GHSA-phv8-wgjp-g4p9 copyparty (PyPI) Fixed in 1.20.19 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-12 Threatist record created from CVE-2026-104102
  2. 2026-10-13 Affected versions changed · Red Hat
  3. 2026-10-13 CVSS score added · Red Hat
  4. 2026-10-13 CISA SSVC decision points changed
  5. 2026-10-16 Alias added: GHSA-phv8-wgjp-g4p9
  6. 2026-10-16 Fix available: PyPI/[email protected] · GHSA-phv8-wgjp-g4p9
  7. 2026-10-16 CVSS score added · GHSA-phv8-wgjp-g4p9
  8. 2026-10-16 Weakness changed · GHSA-phv8-wgjp-g4p9
  9. 2026-10-16 5 new references · GHSA-phv8-wgjp-g4p9

References

Advisory 1

Other 4

  • TI-2025-34551 Copyparty is vulnerable to Regex Denial of Service (ReDoS) attacks through "Recent Uploads" page CVSS 3.1HIGH 7.5
  • TI-2023-19082 Path traversal in copyparty CVSS 3.1HIGH 7.5
  • TI-2023-21990 Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to… CVSS 3.1HIGH 7.8
  • TI-2023-19881 copyparty vulnerable to reflected cross-site scripting via k304 parameter CVSS 3.1MEDIUM 6.3
  • TI-2025-34228 copyparty has a DOM-Based XSS vulnerability when displaying multimedia metadata CVSS 3.1MEDIUM 6.1
  • TI-2025-20002 copyparty renders unsanitized filenames as HTML when user uploads empty files CVSS 3.1MEDIUM 6.1
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences