CVE-2026-104102 9001 CVE debrief

Who should care

System administrators and security teams responsible for copyparty instances, especially those with FTP or FTPS enabled, should assess exposure and prioritize updating to the fixed version.

Why it matters

This vulnerability allows low-privileged users with FTP or FTPS access to potentially create files outside of configured volumes in copyparty. While the files are created with randomized names and cannot be executed or overwritten by the attacker, they could be processed by other software on the host. The issue is fixed in version 1.20.19, and administrators should assess exposure and update as necessary.

• Potential creation of unauthorized files on the system
• Possible impact on unrelated software processing newly created files
• Need for verification of copyparty version and configuration
• Potential for increased monitoring of file system changes

Technical summary

The copyparty file server, when using FTP or FTPS, does not properly confine uploaded files to configured volumes. This allows a low-privileged authenticated user to potentially create files outside of the intended directories, with filenames that have randomized suffixes. The vulnerability is fixed in version 1.20.19. To mitigate, system administrators should focus on restricting FTP and FTPS access, limiting user privileges, and closely monitoring file system changes for suspicious activity. Upgrading to the latest version is crucial, but additional defensive measures may be necessary to prevent exploitation.

Defensive priority

Medium priority for systems using copyparty with FTP or FTPS enabled, especially where low-privileged users have access.

Recommended defensive actions

• Assess exposure of copyparty instances with FTP or FTPS enabled
• Verify if low-privileged users have upload access
• Update to version 1.20.19 or later
• Monitor for unusual file creation patterns
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, its impact, and the fixed version. However, there is limited information on potential exploitation or affected systems. To verify exposure, defenders should check for copyparty instances with FTP or FTPS enabled, review user access levels, and monitor for unusual file creation patterns. The randomized suffixes of created files limit but do not eliminate potential risk. Further investigation may be needed to determine the full scope of affected systems and potential 3

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.