copyparty EUVD-2026-86466

Requires a valid authenticated SFTP account (PR:L) on a copyparty instance with the SFTP front end enabled, plus the ability to create or reach symlinks that leave the volume's top directory so the _mkdir/_rmdir/_chattr handlers resolve to paths outside the account's authorized volume. Limiting factors: SFTP front end must be in use, exploitation depends on symlink traversal succeeding (hence AC:H), and impact is bounded to filesystem locations the copyparty server process can reach. Instances with SFTP disabled, or where all SFTP accounts are fully trusted, are effectively not at risk. Impact is write/modify/delete only - there is no read/exfiltration primitive.

This is a genuine but moderate-severity authorization-boundary flaw, not an inflated high-CVSS issue. The vendor/VulnCheck CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N) is internally consistent with the description: exploitation is network-reachable but requires an existing authenticated SFTP account (PR:L) and depends on manipulating/traversing symlinks that leave a volume's top directory (AC:H), yielding integrity-only impact (arbitrary create/remove/truncate) with no confidentiality or availability scoring. Publicly available exploit code exists (a write-up blog is referenced), which raises practical risk above a purely theoretical finding, but there is NO EPSS score and NO CISA KEV listing provided, so there is no evidence of active or widespread exploitation - treat the public PoC as an enablement signal, not proof of in-the-wild use. Signals are broadly aligned (post-auth, integrity-focused, PoC exists) rather than conflicting; the main caveat is that the CVSS scores availability as N even though truncating or deleting arbitrary files outside the volume can plausibly destroy data or break the host - defenders should not read VA:N as 'no operational harm.' Overall priority is moderate: patch promptly on internet-exposed multi-user instances, lower urgency where SFTP is disabled or all accounts are trusted.

An attacker who holds (or phishes/registers) a low-privilege SFTP account on an exposed copyparty server connects over SSH and uses the _mkdir, _rmdir, or _chattr handlers, which build paths via vfs.get()/vn.canonical()/os.path.join() without the chk_ap access check. By pointing operations at symlinks that escape the volume's top directory and issuing SSH_FXP_SETSTAT, they create, delete, or truncate files anywhere the server process can reach, outside any volume the account should touch. Public exploit/write-up material for this technique is already available, lowering the effort required.