Path Traversal in 9001 Copyparty
CVE-2023-37474
Copyparty is a portable file server. Versions prior to 1.8.2 are subject to a path traversal vulnerability detected in the `.cpr` subfolder. The Path Traversal attack technique allows an attacker access to files, directories, and commands that reside outside the web document root directory. This issue has been addressed in commit `043e3c7d` which has been included in release 1.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS 0.449, 98.8th percentile (scored ); unchanged over 30 days. About EPSS.
Affected products
- 9001 Copyparty — versions < 1.8.2
Weakness classification (CWE)
Public exploits and proof-of-concept code
2 public repositories with exploit or proof-of-concept code for this CVE:
- 0D00-0721-0/hdu-is-work1-copyparty-cve-2023-37474 (last pushed 2026-11-02): HDU IS Work 1: secure Flask REST API, security CI, and CVE-2023-37474 (copyparty) reproduction and remediation
- ilqarli27/CVE-2023-37474 (last pushed 2023-07-28)
Also mentioned in 4 other repositories (fkie-cad/nvd-json-data-feeds, mikuyaQAQ/23NBugRange, nomi-sec/PoC-in-GitHub, …). These reference the CVE in a list, notes or a scanner and are not exploit code for it.
References
This CVE has public exploit evidence. See the latest CVEs with public exploits.