A flaw in copyparty’s FTP upload routine allows low‑privileged authenticated users to embed traversal paths into the remote filename. The server then writes the incoming data to a location outside of the configured service volumes. The file name is suffixed with a random string, the file is not executed by copyparty, and the attacker cannot read, modify, or delete it. However, other software that has write access to the same host may subsequently process or execute this newly created file, exposing the system to further compromise. This issue is a classic path traversal weakness (CWE‑22).

copyparty versions preceding 1.20.19 are affected. The vulnerability is present only when FTP or FTPS is enabled; the default install path and volume limits are bypassed during file upload.

The CVSS score of 5.3 classifies the flaw as medium severity. An attacker only needs authenticated FTP/FTPS access to submit a malicious path and must also have write permissions on the host. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating a lower likelihood of active exploitation at the time of assessment. The attack vector is network‑based and relies on the ability to authenticate to the service, meaning that securing the FTP/FTPS interface reduces the risk.