What’s Vulnerable › Vulnerabilities

CVE-2023-37474: Path traversal in copyparty

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 44.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-07-14 · updated 2026-06-17
• Weakness: CWE-22

Description

Copyparty is a portable file server. Versions prior to 1.8.2 are subject to a path traversal vulnerability detected in the `.cpr` subfolder. The Path Traversal attack technique allows an attacker access to files, directories, and commands that reside outside the web document root directory. This issue has been addressed in commit `043e3c7d` which has been included in release 1.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products

• 9001 copyparty: before 1.8.2 — fixed in 1.8.2

How to fix

Upgrade to a fixed version: 9001 copyparty 1.8.2. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/173822/Copyparty-1.8.2-Directory-Traversal.html
• https://github.com/9001/copyparty/commit/043e3c7dd683113e2b1c15cacb9c8e68f76513ff
• https://github.com/9001/copyparty/security/advisories/GHSA-pxfv-7rr3-2qjg
• http://packetstormsecurity.com/files/173822/Copyparty-1.8.2-Directory-Traversal.html
• https://github.com/9001/copyparty/commit/043e3c7dd683113e2b1c15cacb9c8e68f76513ff
• https://github.com/9001/copyparty/security/advisories/GHSA-pxfv-7rr3-2qjg

Get alerted when CVE-2023-37474 or the next vulnerability affects your stack