CVE-2026-93353

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-93353

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-93353.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2026-93353

Published

2026-09-24T20:29:36Z

Modified

2026-09-25T11:47:23Z

Severity

6.0 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

copyparty SFTP Volume Restriction Bypass via mkdir/rmdir/chattr Handlers

Details

copyparty contains a volume restriction bypass vulnerability in its SFTP front end that allows authenticated SFTP users to create, remove, and truncate arbitrary paths outside permitted volume boundaries by exploiting three handlers that bypass the xvol volflag enforcement. The _mkdir, _rmdir, and _chattr handlers construct destination paths using vfs.get(), vn.canonical(), and os.path.join() without invoking the chk_ap access check, enabling attackers to traverse symlinks leaving a volume's top directory and perform unauthorized file creation, deletion, or truncation via SSH_FXP_SETSTAT operations on paths outside any volume the account is authorized to access.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-424",
        "CWE-59"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93353.json"
}

References

Affected packages

Git / github.com/9001/copyparty

Affected ranges

Type

GIT

Repo

https://github.com/9001/copyparty

Events

Introduced

Last Affected

5ccc999f3975830c3bb308ecb1781ddf84b88db4

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.20.24"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v0.*

v0.10.1

v0.10.10

v0.10.11

v0.10.12

v0.10.13

v0.10.14

v0.10.15

v0.10.16

v0.10.17

v0.10.18

v0.10.19

v0.10.2

v0.10.20

v0.10.21

v0.10.22

v0.10.3

v0.10.4

v0.10.5

v0.10.6

v0.10.7

v0.10.8

v0.10.9

v0.11.0

v0.11.1

v0.11.10

v0.11.11

v0.11.12

v0.11.13

v0.11.14

v0.11.15

v0.11.16

v0.11.17

v0.11.18

v0.11.19

v0.11.20

v0.11.21

v0.11.22

v0.11.23

v0.11.24

v0.11.25

v0.11.26

v0.11.27

v0.11.28

v0.11.29

v0.11.30

v0.11.31

v0.11.32

v0.11.33

v0.11.34

v0.11.35

v0.11.36

v0.11.37

v0.11.38

v0.11.39

v0.11.4

v0.11.40

v0.11.41

v0.11.42

v0.11.43

v0.11.44

v0.11.45

v0.11.46

v0.11.47

v0.11.6

v0.11.7

v0.11.8

v0.11.9

v0.12.0

v0.12.1

v0.12.10

v0.12.11

v0.12.12

v0.12.2

v0.12.3

v0.12.4

v0.12.5

v0.12.6

v0.12.7

v0.12.8

v0.12.9

v0.13.0

v0.13.1

v0.13.10

v0.13.11

v0.13.12

v0.13.13

v0.13.14

v0.13.2

v0.13.3

v0.13.4

v0.13.5

v0.13.6

v0.13.7

v0.13.8

v0.13.9

v0.2.3

v0.3.0

v0.3.1

v0.4.0

v0.4.1

v0.4.2

v0.4.3

v0.5.0

v0.5.1

v0.5.2

v0.5.3

v0.5.4

v0.5.5

v0.5.6

v0.5.7

v0.6.0

v0.6.2

v0.6.3

v0.7.0

v0.7.1

v0.7.2

v0.7.3

v0.7.4

v0.7.5

v0.7.6

v0.7.7

v0.8.1

v0.8.3

v0.9.0

v0.9.1

v0.9.10

v0.9.11

v0.9.12

v0.9.13

v0.9.3

v0.9.4

v0.9.5

v0.9.6

v0.9.7

v0.9.8

v0.9.9

v1.*

v1.0.0

v1.0.1

v1.0.10

v1.0.11

v1.0.12

v1.0.13

v1.0.14

v1.0.2

v1.0.3

v1.0.4

v1.0.5

v1.0.6

v1.0.7

v1.0.8

v1.0.9

v1.1.0

v1.1.1

v1.1.10

v1.1.11

v1.1.12

v1.1.2

v1.1.3

v1.1.4

v1.1.5

v1.1.6

v1.1.7

v1.1.8

v1.1.9

v1.11.0

v1.11.1

v1.11.2

v1.12.0

v1.12.1

v1.12.2

v1.13.0

v1.13.1

v1.13.2

v1.13.3

v1.13.4

v1.13.5

v1.13.6

v1.13.8

v1.14.0

v1.14.1

v1.14.2

v1.14.3

v1.14.4

v1.15.0

v1.15.1

v1.15.10

v1.15.2

v1.15.3

v1.15.4

v1.15.5

v1.15.6

v1.15.7

v1.15.8

v1.15.9

v1.16.0

v1.16.1

v1.16.10

v1.16.11

v1.16.12

v1.16.13

v1.16.14

v1.16.15

v1.16.16

v1.16.17

v1.16.18

v1.16.19

v1.16.2

v1.16.20

v1.16.21

v1.16.3

v1.16.4

v1.16.5

v1.16.6

v1.16.7

v1.16.8

v1.16.9

v1.17.0

v1.17.1

v1.17.2

v1.18.0

v1.18.1

v1.18.10

v1.18.2

v1.18.3

v1.18.4

v1.18.5

v1.18.6

v1.18.7

v1.18.8

v1.18.9

v1.19.0

v1.19.1

v1.19.10

v1.19.11

v1.19.12

v1.19.13

v1.19.14

v1.19.15

v1.19.16

v1.19.17

v1.19.18

v1.19.19

v1.19.2

v1.19.20

v1.19.21

v1.19.22

v1.19.23

v1.19.3

v1.19.4

v1.19.5

v1.19.6

v1.19.7

v1.19.8

v1.19.9

v1.2.0

v1.2.1

v1.2.10

v1.2.11

v1.2.2

v1.2.3

v1.2.4

v1.2.5

v1.2.6

v1.2.7

v1.2.8

v1.2.9

v1.20.0

v1.20.1

v1.20.10

v1.20.11

v1.20.12

v1.20.13

v1.20.14

v1.20.15

v1.20.16

v1.20.17

v1.20.18

v1.20.19

v1.20.2

v1.20.20

v1.20.21

v1.20.22

v1.20.23

v1.20.24

v1.20.3

v1.20.4

v1.20.5

v1.20.6

v1.20.7

v1.20.8

v1.20.9

v1.3.0

v1.3.1

v1.3.10

v1.3.11

v1.3.12

v1.3.13

v1.3.14

v1.3.15

v1.3.16

v1.3.2

v1.3.3

v1.3.4

v1.3.5

v1.3.6

v1.3.7

v1.3.8

v1.3.9

v1.4.0

v1.4.1

v1.4.2

v1.4.3

v1.4.4

v1.4.5

v1.4.6

v1.5.0

v1.5.1

v1.5.2

v1.5.3

v1.5.4

v1.5.5

v1.5.6

v1.6.0

v1.6.1

v1.6.10

v1.6.11

v1.6.12

v1.6.13

v1.6.14

v1.6.15

v1.6.2

v1.6.3

v1.6.4

v1.6.5

v1.6.6

v1.6.7

v1.6.8

v1.6.9

v1.7.0

v1.7.1

v1.7.2

v1.7.3

v1.7.4

v1.7.5

v1.7.6

v1.8.0

v1.8.1

v1.8.2

v1.8.3

v1.8.4

v1.8.6

v1.8.7

v1.8.8

v1.9.0

v1.9.1

v1.9.10

v1.9.11

v1.9.12

v1.9.13

v1.9.14

v1.9.15

v1.9.16

v1.9.17

v1.9.18

v1.9.19

v1.9.2

v1.9.20

v1.9.21

v1.9.22

v1.9.23

v1.9.24

v1.9.25

v1.9.26

v1.9.27

v1.9.28

v1.9.29

v1.9.3

v1.9.30

v1.9.4

v1.9.5

v1.9.6

v1.9.7

v1.9.8

v1.9.9

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-93353.json"