copyparty EUVD-2026-97760

FTP or FTPS must be explicitly enabled on the copyparty instance - this is not the default, so instances without FTP configured are unaffected. The attacker needs a valid low-privileged authenticated FTP account (PR:L). Exploitation is further LIMITED because the attacker can only create new files, not read or overwrite existing ones; the written filename receives a randomized suffix so the exact output name is not attacker-controlled; writes are bounded to directories where the copyparty process already has write permission; and copyparty never executes the file, so meaningful impact requires other software on the same host to pick up and process the newly created file.

This is a genuine but modest-priority issue, best treated as a configuration-dependent integrity/sandbox-escape flaw rather than a critical RCE. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N) scores 5.3 (Medium): network-reachable but requiring both an authenticated low-privileged account (PR:L) and a specific precondition (AT:P) - namely that FTP/FTPS is explicitly enabled, which is NOT copyparty's default. Impact is limited: VI:L reflects that the attacker can only CREATE new files (no read, no overwrite) and the output name receives a randomized suffix; copyparty itself never executes the file. The elevated subsequent-system metrics (SC:H/SI:H) are the real risk driver - a dropped file could be consumed by unrelated software on the host, converting a constrained write primitive into broader impact depending on what else runs there. On exploitation signals: not listed in CISA KEV, and no public exploit code was identified (the GitHub 'source code evidence' is the vendor fix commit, not a POC). EPSS was not provided and no SSVC decision data was supplied, so automatability and exploitation-maturity cannot be quantified from the input - treat those as unknown. Net: a real, patchable weakness worth remediating promptly for anyone running copyparty with FTP enabled, but low urgency for the majority of deployments that do not enable FTP/FTPS.

An administrator has explicitly enabled FTP or FTPS on a copyparty instance and provisioned a low-privileged account. The authenticated attacker issues an upload using a directory-traversal path (e.g. ../../) to write a file outside the configured copyparty volumes into any directory the copyparty process can write to, such as a location monitored or auto-processed by another service on the host. No public exploit code was identified at time of analysis, though the fix commit is public.