CVE-2026-93353: copyparty SFTP Volume Guard Bypass via Path Traversal

CVE-2026-93353: Summary of the Volume Guard Vulnerability Vulnerability Overview Vulnerability Type: Path Traversal / Symlink Escape Core Issue: The SFTP frontend in file server fails to correctly parse symbolic links when handling specific operations, allowing attackers to access files outside of the designated Volume directory. Root Cause: The code implements a "Volume Guard" mechanism ( flag) intended to prevent users from accessing files outside the Volume directory. However, three specific handler functions in the SFTP frontend ( , , ) resolve paths using or directly, bypassing the unified (virtual to absolute) conversion function. Consequently, if a symbolic link pointing outside the Volume exists within the Volume, these operations act directly on the target path, bypassing security restrictions. Scope of Impact Affected Component: SFTP frontend Affected Versions: 1.20.24 and earlier (as of the time of writing, the current version 1.20.24 remains unfixed). Affected Operations: (Create directory) (Remove directory) (Modify file attributes, e.g., size) Attack Scenario: The attacker must possess a symbolic link within the Volume that points outside the Volume (e.g., created via upload functionality or a prior vulnerability). Remediation Official Fix Status: As of the time of writing, the vendor has not released a fix. Recommended Remediation (Based on Analysis): The analysis indicates that the correct approach is to ensure all SFTP operations route path resolution through the unified function, which verifies that the resolved absolute path remains within the Volume directory. The specific fix logic should mirror the implementation of the function: 1. Retrieve the virtual path. 2. Convert it to an absolute path (resolving symbolic links). 3. Check if the absolute path starts with the Volume path ( ). 4. If it is not within the Volume, raise an or . Code Example (Correct Guard Logic): Remediation Approach for Affected Functions: , , and should call instead of directly using functions. POC / Exploit Code The article contains a Python code snippet demonstrating the vulnerability, showing how Volume restrictions can be bypassed via SFTP operations. Note: The article does not provide a complete, directly runnable POC script; rather, it demonstrates the vulnerability principle through code analysis and logical deduction. The code block above is a demonstration reconstructed based on the logic described in the article. Key Conclusions This is a severe logical vulnerability stemming from inconsistent application of security guards in the code. The remediation is clear: uniformly use for path resolution and permission checks. Users should upgrade to a version containing the fix (currently unreleased), or manually patch the SFTP frontend code to ensure , , and are all subject to checks.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-93353: copyparty SFTP Volume Guard Bypass via Path Traversal