These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A limited path traversal vulnerability exists in copyparty, a portable file server, prior to version 1.20.19. When FTP or FTPS is enabled, a low-privileged authenticated user can upload files outside of configured volumes, potentially creating new files with randomized suffixes in areas where the copyparty process has write permissions. While the attacker cannot read or overwrite files, and copyparty does [truncated]
Authenticated SFTP users can bypass volume restrictions in copyparty's SFTP front end to create, remove, and truncate arbitrary paths outside permitted volume boundaries. This vulnerability, tracked as CVE-2026-93353, allows attackers to exploit three handlers (_mkdir, _rmdir, and _chattr) that bypass the xvol volflag enforcement, potentially leading to unauthorized file operations and symlink traversal. [truncated]
CVE-2026-70657 is a vulnerability in Copyparty, a portable file server, that allows unauthorized access to folders when specific directory-key and file-key flags are enabled. The issue was fixed in version 1.20.17. This vulnerability requires attention from users with specific configurations, as it can lead to potential unauthorized folder access and impact data confidentiality. Defenders should verify th [truncated]