CVE-2026-93353: copyparty SFTP Volume Restriction Bypass via mkdir/rmdir/chattr Handlers
copyparty contains a volume restriction bypass vulnerability in its SFTP front end that allows authenticated SFTP users to create, remove, and truncate arbitrary paths outside permitted volume boundaries by exploiting three handlers that bypass the xvol volflag enforcement. The mkdir, rmdir, and chattr handlers construct destination paths using vfs.get(), vn.canonical(), and os.path.join() without invoking the chkap access check, enabling attackers to traverse symlinks leaving a volume's top directory and perform unauthorized file creation, deletion, or truncation via SSHFXPSETSTAT operations on paths outside any volume the account is authorized to access.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments that provide authenticated SFTP access are exposed where a user can traverse a symlink that leads outside the top directory of an authorized volume. The issue affects enforcement of volume boundaries in the SFTP front end.
What does an attacker need to exploit this issue?
An attacker needs valid SFTP authentication with low-level privileges and must be able to use the affected mkdir, rmdir, or chattr operations against paths that traverse a symlink outside an allowed volume. No user interaction is required.
What actions can exploitation perform outside the authorized volume?
The bypass can allow unauthorized creation, removal, or truncation of arbitrary paths outside volumes the account is authorized to access. The described truncation path uses SSH_FXP_SETSTAT operations.