CVE-2026-104102

copyparty is a portable file server. Prior to 1.20.19, FTP upload path handling does not confine destinations to configured copyparty volumes. When FTP or FTPS is explicitly enabled, a low-privileged authenticated user can submit traversal paths during upload to create a new file outside configured volumes wherever the copyparty process has write permission. The attacker cannot read or overwrite files, the output name receives a randomized suffix, and copyparty does not execute the file; however, unrelated software on the same host could process the newly created file. This issue is fixed in version 1.20.19.

• CWE-22

• https://github.com/9001/copyparty/commit/b331bb1c8c8cc306b91e4d94221969335a7a3e86
• https://github.com/9001/copyparty/releases/tag/v1.20.19
• https://github.com/9001/copyparty/security/advisories/GHSA-phv8-wgjp-g4p9
• https://github.com/9001/copyparty/security/advisories/GHSA-phv8-wgjp-g4p9
• https://github.com/9001/copyparty/security/advisories/GHSA-phv8-wgjp-g4p9
• https://github.com/9001/copyparty/security/advisories/GHSA-phv8-wgjp-g4p9

Published

Oct 12, 2026

Last Modified

Oct 13, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-104081KodExplorer before 4.55 contains a path traversal vulnerabil…8.1
• CVE-2026-104082SmarterMail before build 9777 contains a remote code executi…7.2
• CVE-2026-104083SmarterMail before build 9777 contains a stored mutation cro…6.1
• CVE-2026-104084SmarterMail before build 9777 contains a privilege escalatio…8.8
• CVE-2026-104085odt2spip plugin for SPIP before 4.4.0 contains an OS command…8.8
• CVE-2026-1040867-Zip before 26.03 contains an uninitialized memory disclosu…5.5
• CVE-2026-104103Ludwig is a low-code framework for building custom LLMs, neu…8.1
• CVE-2026-104105FileRise is a self-hosted web-based file manager with multi-…6.4
• CVE-2026-104106FileRise is a self-hosted web-based file manager with multi-…6.5
• CVE-2026-104107FileRise is a self-hosted web-based file manager with multi-…6.5
• CVE-2026-104108FileRise is a self-hosted web-based file manager with multi-…8.1
• CVE-2026-104109FileRise is a self-hosted web-based file manager with multi-…6.8