CVE-2026-104102: Copyparty FTP Limited Path Traversal Vulnerability
Summary
CVE-2026-104102: copyparty FTP: upload outside defined volumes (limited path traversal). Affects copyparty versions < 1.20.19. Fixed in 1.20.19. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Copyparty is an open-source file sharing server that allows users to upload and share files over FTP, FTPS, and SFTP protocols. It is designed for ease of use and flexibility, enabling users to configure their file sharing environment. However, when the FTP or FTPS server is enabled, it can inadvertently allow uploads to directories outside the defined volumes, posing a security risk.
Vulnerability Detail
The vulnerability arises from the FTP and FTPS server functionality in Copyparty, which, when enabled, permits file uploads to any directory that the Copyparty process has permission to write to. This is not a full path traversal vulnerability, as it only affects uploads and does not allow reading or downloading existing files. The output filename is partially controlled, with a randomized suffix added, preventing overwriting of existing files. The main concern is that if other software on the same machine executes files based on arbitrary names, it could lead to security issues. The severity is rated as moderate, with a CVSS score of 5.3.
How To Fix
Latest published version: 1.20.26 as of 22 Oct 2026
pip install --upgrade "copyparty==1.20.26"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.20.19
This is the first release that contains the fix.
pip install --upgrade "copyparty==1.20.19"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update immediately, consider disabling the FTP and FTPS server in the configuration file by setting ftp and ftps options to false. This will prevent the vulnerability from being exploited until you can apply the patch.
Conclusion
The Copyparty FTP vulnerability (CVE-2026-104102) poses a moderate risk by allowing limited path traversal for file uploads. Users are advised to update to version 1.20.19 or later to mitigate this risk. If immediate updates are not possible, disabling the FTP and FTPS features is recommended.
See every vulnerability recorded for copyparty →
FAQ
The vulnerability allows limited path traversal for file uploads via FTP and FTPS, enabling uploads to directories outside defined volumes.
No, SFTP is not affected by this vulnerability; it only impacts FTP and FTPS.
The main risk is that other software on the same machine could execute newly uploaded files if they are named in a way that triggers execution.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
As a temporary measure, disable the FTP and FTPS server in the configuration to mitigate the risk until you can update.
References
Related vulnerabilities
Recent vulnerabilities recorded for copyparty.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
