This flaw allows an authenticated user to manipulate file system paths beyond the limits of the user’s assigned volume by exploiting the _mkdir, _rmdir, and _chattr handlers in copyparty’s SFTP front end. The handlers build destination paths with vfs.get(), vn.canonical(), and os.path.join() without invoking the chk_ap access check, enabling path traversal, symlink escape, and improper handling of special elements. The result is untrusted creation, deletion, or truncation of files and directories that may reside anywhere on the underlying file system, compromising confidentiality, integrity, and availability of data outside the intended workspace.

The vulnerability affects any installation of copyparty that includes the SFTP front end. No specific product version is listed, implying that all versions that expose these handlers are potentially impacted. Users with active SFTP accounts on such systems are at risk.

With a CVSS score of 2.3 the flaw is classified as low severity, and its EPSS score of < 1 % indicates a very low likelihood of exploitation. It is not included in CISA’s KEV catalog. The attack vector requires an authenticated SFTP session; the attacker must possess valid credentials to issue the vulnerable commands. When executed, the lack of proper path validation allows the attacker to traverse symlinks and perform unauthorized operations outside the allowed volume, although the short–term impact is limited to the files and directories the attacker can reach with those credentials.