CVE-2026-104102 copyparty FTP: upload outside defined volumes (limited path traversal)
Authenticated users can upload files outside configured volumes via FTP path traversal, potentially affecting other host software.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-104102?
CVE-2026-104102 is a medium-severity path traversal vulnerability in 9001 copyparty, published on 12 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
copyparty is a portable file server. Prior to 1.20.19, FTP upload path handling does not confine destinations to configured copyparty volumes. When FTP or FTPS is explicitly enabled, a low-privileged authenticated user can submit traversal paths during upload to create a new file outside configured volumes wherever the copyparty process has write permission. The attacker cannot read or overwrite files, the output name receives a randomized suffix, and copyparty does not execute the file; however, unrelated software on the same host could process the newly created file. This issue is fixed in version 1.20.19.
Weakness: CWE-22
Which versions are affected by CVE-2026-104102?
2 open source packages ship an affected version, including copyparty.
| Package | Affected | Fixed in |
|---|---|---|
copyparty PyPI | All versions | 1.20.19 |
copyparty PyPI | All versions | 1.20.19 |
How do I fix CVE-2026-104102?
Upgrade copyparty to 1.20.19 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-104102 being exploited?
There is no known exploitation of CVE-2026-104102 in the wild and no public exploit code.
Sources
Also known as GHSA-phv8-wgjp-g4p9.