CVE-2023-37474: Path Traversal in Copyparty, Update to 1.8.2

Path traversal in Copyparty before 1.8.2: unauthorized access to files and directories. CVSS 7.5 (high).

CVE-2023-37474 is a path traversal vulnerability detected in Copyparty's .cpr folder, a portable file server. The attack allows an attacker to access files, directories, and commands residing outside the web server root. It affects all Copyparty versions prior to 1.8.2. For administrators providing file storage, this is direct exposure of sensitive data.

The CVSS score is 7.5 (high severity), confirmed in official data. The vulnerability has been identified and patched: version 1.8.2, released on 2023-07-14, contains the fix. No workarounds are available. Recent signals on public repositories cite CVE-2023-37474 in remediation and security training contexts, confirming it remains relevant for defenders who have not yet updated their instances.

Administrators managing Copyparty must upgrade immediately to version 1.8.2 or later. Before upgrading, conduct an inventory of Copyparty instances in use and verify the running version. Document applied patches for audit trail and compliance. The lack of workarounds makes upgrading the only valid mitigation option for this CVE.

At a glance

What: Path traversal vulnerability in Copyparty's .cpr folder that allows attackers to access files and directories outside the web server root.
Severity: CVSS 7.5 (high). Unauthorized file access is a concrete risk for Copyparty server administrators.
Affected versions: Copyparty versions prior to 1.8.2 (all versions released before 2023-07-14).
Fix: Upgrade to Copyparty 1.8.2 or later. The fix is included in release 1.8.2.
Status: Patch released on 2023-07-14 (NVD published). No known workarounds. The vulnerability is documented and manageable only through upgrade.
Action: Verify Copyparty version in use. If earlier than 1.8.2, upgrade immediately. No workaround exists: upgrade is the only available mitigation.

Sources: NVD, CVE-2023-37474

← All articles