Vulnerability · CVE-2026-104102
copyparty FTP: upload outside defined volumes (limited path traversal)
Published Oct 12, 2026 · catalog updated Oct 15, 2026 · copyparty FTP: upload outside
Check if you run it
No confirmed exploitation is on record for CVE-2026-104102. EPSS is 0.31%. Act only if a listed version of copyparty FTP: upload outside is installed.
Gaps on this record
- The stored product name is a package slug. The name on this page is taken from the title (copyparty FTP: upload outside).
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
- Severity
- Medium5.3
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- 0.31%
- Remediation
- Version ranges on file
- Affected products
- PyPI copyparty · pip copyparty · pypi copyparty · vendor 9001 copyparty
The FTP and FTPS server -- if enabled -- would allow uploading to any folder that the copyparty process had permission to write to. The FTP-server is default-disabled, and must be explicitly enabled in the config with global-option or to be affected. Additionally, SFTP was not affected at all; only FTP and FTPS. This was not a full read/write path-traversal; it had the following limitations: * Only applied to uploads; it was not possible to read/download existing files in this manner. * The output filename was not fully controllable; a randomized suffix would always be appended to the filename. * Existing files could not be overwritten or appended to; only new files could be created. * Filesystem-permissions would prevent writing to system folders, as copyparty surely does not run as root in most deployments. * Copyparty itself will not execute arbitrary files as code by default, so this vulnerability could not be used to execute arbitrary code through copyparty. The main concern is the potential effect on other unrelated software which is running on the same system. The severity is assuming the worst case (SC:H/SI:H), that the same machine is running some unrelated software that will execute new arbitrarily-named files as code, and that the copyparty process has sufficient privileges to write files into the config-folder of that unrelated software.
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- PyPI copyparty0 → 1.20.19
- pip copyparty< 1.20.19
- pypi copypartyversion unspecified
- vendor 9001 copypartyversion unspecified
How to fix CVE-2026-104102
Recommended remediation
Affected version ranges suggest a fixed boundary. Verify against the vendor advisory for your release.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
No confirmed exploitation is on record for CVE-2026-104102. EPSS is 0.31%. Act only if a listed version of copyparty FTP: upload outside is installed.
Which versions are affected?
Compare what you have installed with 0 → 1.20.19, < 1.20.19. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
CWE-22: Path Traversal. EPSS 0.31%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 15, 2026 · GitHub Advisory Database
Detected
The FTP and FTPS server -- if enabled -- would allow uploading to any folder that the copyparty process had permission to write to. The FTP-server is default-disabled, and must be explicitly enabled in the config with global-option or to be affected. Additionally, SFTP was not affected at all; only FTP and FTPS. This was not a full read/write path-traversal; it had the following limitations: * Onl
Oct 15, 2026 · GitHub Advisory Database
Fix available
copyparty fixed in 1.20.19
Oct 15, 2026 · GitHub Advisory Database
Fix available
copyparty fixed in 1.20.19
Oct 15, 2026 · GitHub Advisory Database
Updated
The FTP and FTPS server -- if enabled -- would allow uploading to any folder that the copyparty process had permission to write to. The FTP-server is default-disabled, and must be explicitly enabled in the config with global-option or to be affected. Additionally, SFTP was not affected at all; only FTP and FTPS. This was not a full read/write path-traversal; it had the following limitations: * Onl
Sources
- CVE.orgVulnerability recordCVE-2026-104102
copyparty is a portable file server. Prior to 1.20.19, FTP upload path handling does not confine destinations to configured copyparty volumes. When FTP or FTPS is explicitly enabled, a low-privileged authenticated user can submit traversal paths during upload to create a new file
cve.org - FIRST EPSSExploitation probabilityCVE-2026-104102
30-day exploitation probability 0.3%
first.org - GitHub Advisory DatabasePackage advisoryGHSA-phv8-wgjp-g4p9
copyparty FTP: upload outside defined volumes (limited path traversal)
github.com - GitLab Advisory DatabasePackage advisoryCVE-2026-104102
The FTP and FTPS server – if enabled – would allow uploading to any folder that the copyparty process had permission to write to. The FTP-server is default-disabled, and must be explicitly enabled in the config with global-option ftp or ftps to be affected. Additionally, SFTP was not affected at all; only FTP and FTPS. This was not a full read/write path-traversal; it had the following
advisories.gitlab.com - OpenSSF OSV / OSV ScannerPackage advisoryGHSA-phv8-wgjp-g4p9
copyparty FTP: upload outside defined volumes (limited path traversal)
osv.dev - PyPA Advisory DatabasePackage advisoryGHSA-phv8-wgjp-g4p9
copyparty FTP: upload outside defined volumes (limited path traversal)
osv.dev
References
Freshness
Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.