CVE-2026-93353 9001 CVE debrief

Who should care

Defenders responsible for copyparty installations, SFTP servers, and file system security should assess exposure and prioritize patching and monitoring. This includes SFTP administrators, security teams, and IT personnel responsible for ensuring the security and integrity of file systems and data. Additionally, organizations using copyparty should review their current configurations and consider implementing additional security measures to prevent similar

Why it matters

Authenticated SFTP users can bypass volume restrictions in copyparty's SFTP front end, potentially leading to unauthorized file operations and symlink traversal. Defenders should prioritize verifying and patching copyparty installations, restricting SFTP access, and monitoring for suspicious activity.

• Potential unauthorized file creation, deletion, or truncation outside permitted volume boundaries
• Possible symlink traversal to access sensitive files or directories
• Required verification of patching and access controls to prevent exploitation
• Need for enhanced monitoring and logging to detect suspicious SFTP activity

Technical summary

The _mkdir, _rmdir, and _chattr handlers in copyparty's SFTP front end construct destination paths using vfs.get(), vn.canonical(), and os.path.join() without invoking the chk_ap access check, enabling attackers to traverse symlinks and perform unauthorized file operations. This vulnerability allows attackers to bypass volume restrictions and potentially lead to unauthorized file creation, deletion, or truncation outside permitted volume boundaries. The CVE record provides additional context on the vulnerability, including its CVSS score of 6 and MEDIUM severity.

Defensive priority

Defenders should prioritize verifying and patching copyparty installations to prevent unauthorized file operations.

Recommended defensive actions

• Verify and apply patches for copyparty installations
• Restrict SFTP access to trusted users and monitor for suspicious activity
• Implement additional access controls and logging to detect potential exploitation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by three handlers (_mkdir, _rmdir, and _chattr) that bypass the xvol volflag enforcement, allowing attackers to traverse symlinks and perform unauthorized file operations. This issue is particularly concerning as it enables attackers to create, remove, and truncate arbitrary paths outside permitted volume boundaries. The CVE record was published on 2026-09-24T21:18:58.310Z and has not been modified since then. Evidence is based on official CVE Program and NVD sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.