CVE-2026-93353

Executive Summary

CVE-2026-93353 is a volume restriction bypass vulnerability in the SFTP front end of copyparty, an open-source file-sharing and file-server application. Authenticated SFTP users can exploit three internal path handlers that fail to invoke the access-control check, allowing them to create, remove, and truncate arbitrary paths outside their permitted volume boundaries. The impact is high integrity loss (I:H) — unauthorized file creation, deletion, and truncation on the host filesystem — with no confidentiality or availability impact scored under CVSS v3.1 (5.3, Medium).

Technical Analysis

copyparty enforces per-account volume restrictions — a concept the project refers to as a "volume" (a permitted directory tree) — using a "volflag" named xvol. The xvol volflag is intended to constrain authenticated SFTP users to the top directory of the volume(s) they are authorized to access. According to the NVD description, the SFTP front end contains three handlers that bypass this enforcement: _mkdir, _rmdir, and _chattr.

These three handlers construct destination paths using vfs.get(), vn.canonical(), and os.path.join() without invoking the chk_ap access check. Because chk_ap (the access-path check) is the enforcement point that validates a requested path against the account's permitted volume boundaries, skipping it means the path is resolved and acted upon without any authorization validation.

The vulnerability class is CWE-59 (Improper Link Resolution Before File Access, i.e., "Link Following"). The bypass works by traversing symlinks that leave a volume's top directory. When a user requests an operation on a path that resolves through a symlink pointing outside the permitted volume, the handler follows that symlink and operates on the target path — outside any volume the account is authorized to access.

The attack surface is the SFTP front end and is reachable over the network (AV:N). It requires authentication (PR:L) and the successful circumvention of the volume boundary depends on the presence of a traversable symlink leaving the volume's top directory, which raises attack complexity (AC:H). No user interaction is required (UI:N) and the scope remains unchanged (S:U).

Two operations are affected:

1. Filesystem mutation via SFTP handlers — _mkdir and _rmdir allow creation and removal of directories at arbitrary resolved paths outside permitted volumes.
2. Attribute/state manipulation — _chattr is invoked through SSH_FXP_SETSTAT operations. The NVD description ties the SSH_FXP_SETSTAT operation to unauthorized file creation, deletion, or truncation, indicating that setstat-based requests reach the vulnerable _chattr handler and act on out-of-volume paths.

The description is precise about the mechanism (missing chk_ap call in three handlers, path construction via vfs.get() / vn.canonical() / os.path.join(), symlink traversal) but does not disclose the exact SFTP request sequence, file sizes, or flag values needed to trigger truncation. No CVE CNA title, affected version list, OSV package data, or vendor advisory was provided in the tracked intelligence data. Any statement about specific release versions, commit hashes, or config directives beyond xvol and chk_ap would be speculation and is therefore omitted. As of this writing, the vulnerability is UNPATCHED across all tracked sources with a patch confidence of 0/4.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available for CVE-2026-93353. The attack chain below is inferred strictly from the vulnerability class and the NVD description supplied above; no function names, endpoints, or parameters beyond those in the description are asserted.

1. Reconnaissance / target identification — An attacker identifies an internet-exposed copyparty instance with the SFTP front end enabled (network vector, AV:N). The attacker must possess valid credentials for an account with limited (volume-restricted) access — the described scenario involves "authenticated SFTP users" (PR:L).

2. Precondition establishment — The bypass requires that a path the account can reference already resolve through a symlink that points outside its permitted volume, which is why the CVSS vector rates attack complexity as High (AC:H). The attacker must locate or cause such a link within the reachable volume tree.

3. Triggering the specific flaw class — The attacker issues SFTP operations that route to the vulnerable handlers: directory creation/removal requests handled by _mkdir and _rmdir, and SSH_FXP_SETSTAT operations handled by _chattr. Because these handlers construct the destination path via vfs.get() / vn.canonical() / os.path.join() without calling chk_ap, the resulting syscall targets the symlink-resolved path outside the volume boundary rather than being blocked. This is a link-following / path-validation flaw: the operation executes at the vulnerability-class level by resolving a path without re-validating it against the account's authorized volume.

4. Post-exploitation impact — Successful exploitation allows the attacker to create, remove, and truncate arbitrary paths outside permitted volume boundaries. This constitutes unauthorized integrity modification of files the account should never be able to touch (I:H), potentially enabling tampering with configuration, logs, or other users' data hosted on the same filesystem. No confidentiality or availability impact is scored, and the effect is bounded by filesystem permissions of the copyparty process user.

Impact Assessment

CVSS v3.1 base score 5.3 (Medium): AV:N / AC:H / PR:L / UI:N / S:U / C:N / I:H / A:N.

• Confidentiality (C:N) — the flaw is a write-path bypass (create/remove/truncate); no read/exfiltration impact is claimed.
• Integrity (I:H) — arbitrary creation, deletion, and truncation of files outside authorized volumes constitutes a serious integrity violation. Deletion and truncation are destructive; truncation requires only a SETSTAT operation and can silently zero out file contents.
• Availability (A:N) — although truncation and deletion are destructive, no availability impact is scored in the provided vector.
• Scope (S:U) — impact is confined to the security authority of the vulnerable component.
• Attack complexity (AC:H) — exploitation depends on a resolvable symlink escaping the volume, making it non-trivial but repeatable once a suitable link exists.

Blast radius: Any copyparty deployment that (a) exposes the SFTP front end, (b) relies on xvol/volume restrictions to sandbox authenticated users, and (c) has symlinks or symlink-reachable paths in user-accessible volumes. Multi-tenant or shared file-server installations that depend on volume isolation for tenant separation are most at risk, since the boundary those users are supposed to be constrained within is precisely what the vulnerability defeats. Because copyparty is commonly self-hosted and may be internet-facing, exposed instances should be treated as exposed to integrity tampering by any authenticated low-privilege user.

CISA KEV status: NOT listed. EPSS: not yet scored by FIRST.org — no EPSS value is fabricated here.

Detection Guidance

Sigma Rule

title: Suspicious copyparty SFTP Volume Boundary Escape via SETSTAT
id: 3f7a2c91-6b4e-4d2a-9c1f-0e5b8d7a4c22
status: experimental
description: Detects SFTP SETSTAT operations and directory create/remove activity against copyparty that may indicate exploitation of CVE-2026-93353 (volume restriction bypass via _mkdir/_rmdir/_chattr)
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-93353
author: valtersit.com
date: 2026/01/01
logsource:
  category: process_creation
  product: linux
detection:
  selection_proc:
    Image|endswith: '/copyparty'
  selection_cmd:
    CommandLine|contains:
      - '--sftp'
      - 'copyparty'
  condition: selection_proc and selection_cmd
falsepositives:
  - Legitimate administrative SFTP sessions by volume owners
level: medium
tags:
  - attack.t1190
  - cve.2026-93353

YARA Rule

rule CVE_2026_93353_copyparty_xvol_bypass
{
    meta:
        description = "Detects copyparty source/handler artifacts referencing the volume restriction bypass handlers of CVE-2026-93353"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-93353"
        cve = "CVE-2026-93353"

    strings:
        $xvol   = "xvol" ascii
        $chkap  = "chk_ap" ascii
        $mkdir  = "_mkdir" ascii
        $rmdir  = "_rmdir" ascii
        $chattr = "_chattr" ascii
        $setstat = "SSH_FXP_SETSTAT" ascii

    condition:
        uint32(0) != 0x504b0304 and
        $xvol and
        $chkap and
        (2 of ($mkdir, $rmdir, $chattr, $setstat))
}

Suricata IDS Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (msg:"CVE-2026-93353 copyparty SFTP volume restriction bypass attempt (SETSTAT/mkdir/rmdir outside volume)"; flow:to_server,established; content:"SSH-"; depth:4; pcre:"/SSH_FXP_(SETSTAT|MKDIR|RMDIR)/"; reference:cve,2026-93353; classtype:attempted-admin; sid:202693353; rev:1;)

Note: Because SFTP payloads are carried inside an encrypted SSH channel after key exchange, deep-content inspection of the SFTP packet types above is only feasible in environments that decrypt SSH (e.g., via a terminating proxy) or against unencrypted lab/emulated traffic. The rule is provided as a template for such inspection pipelines.

Elastic Detection

process where process.name == "copyparty" and
  process.command_line : "*--sftp*" and
  event.action in ("file_created", "file_deleted", "file_truncated")

Splunk SPL Query

index=* sourcetype=copyparty OR sourcetype=syslog
| search ("copyparty" AND ("sftp" OR "SSH_FXP_SETSTAT" OR "_mkdir" OR "_rmdir" OR "_chattr"))
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, src_ip
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="copyparty,cve-2026-93353,">
  <rule id="2026935" level="10">
    <decoded_as>json</decoded_as>
    <field name="process">copyparty</field>
    <match>sftp|SSH_FXP_SETSTAT|_mkdir|_rmdir|_chattr</match>
    <description>Possible CVE-2026-93353 copyparty SFTP volume restriction bypass activity detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_93353,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch reference, fixed version, vendor advisory, workaround, or affected version range is available from any tracked source. The following are risk-reduction measures, not vendor-confirmed fixes.

1) Immediate mitigations

• Disable or restrict the SFTP front end on copyparty deployments that do not require SFTP access; the vulnerability is specific to the SFTP front end. If SFTP is required, bind it to trusted network ranges and enforce allowlisting at the firewall instead of exposing it to the internet.
• Review and, where possible, eliminate symlinks that resolve outside permitted volume top directories within accounts' accessible trees. The bypass depends on traversing such symlinks, so reducing out-of-volume symlinks removes the evasion precondition (AC:H).
• Apply the principle of least privilege to the OS account running copyparty so that even a successful bypass cannot reach sensitive paths (config, SSH keys, system directories).
• Audit authenticated accounts; remove unused SFTP credentials and ensure no low-trust account shares a filesystem with sensitive data.

2) Patch/upgrade steps

• No patched version exists in tracked sources as of this report. Monitor the copyparty project's official release channels and the NVD entry for CVE-2026-93353. When a fixed release is published, upgrade immediately, then re-verify that _mkdir, _rmdir, and _chattr now invoke the chk_ap access check.
• Do not rely on any CVE feed claiming a fixed version unless it cites an upstream commit or release — none is currently available.

3) Long-term hardening

• Run copyparty in a container or sandbox with a tightly scoped filesystem view (read-only mounts where possible, dedicated non-privileged user, no broad bind mounts) so that any volume-boundary escape is contained.
• Enforce mandatory access control (SELinux/AppArmor) confining the copyparty process to only the directories it legitimately serves.
• Add integrity monitoring (e.g., file-integrity baselines on served volumes) and alert on unexpected creation, deletion, or truncation, especially on paths outside expected volume roots.
• Require MFA and per-tenant accounts where multi-tenant isolation depends on copyparty volumes, and log all SFTP SETSTAT/directory operations for forensic review.

References

• NVD — CVE-2026-93353: https://nvd.nist.gov/vuln/detail/CVE-2026-93353
• CWE-59 — Improper Link Resolution Before File Access ('Link Following'): https://cwe.mitre.org/data/definitions/59.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• copyparty project source and release channel (for future patch guidance): https://github.com/9001/copyparty
• FIRST.org EPSS (CVE currently unscored — monitor for updates): https://api.first.org/data/v1/epss?cve=CVE-2026-93353

No known threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-93353 at this time. The CVE is not listed in CISA KEV, no public PoC or exploit code is available, and no EPSS score has been assigned by FIRST.org.