CVE-2023-37474: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

July 14, 2023 (updated July 31, 2023)

Copyparty is a portable file server. Versions prior to 1.8.2 are subject to a path traversal vulnerability detected in the .cpr subfolder. The Path Traversal attack technique allows an attacker access to files, directories, and commands that reside outside the web document root directory. This issue has been addressed in commit 043e3c7d which has been included in release 1.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

References

github.com/9001/copyparty/commit/043e3c7dd683113e2b1c15cacb9c8e68f76513ff
github.com/9001/copyparty/security/advisories/GHSA-pxfv-7rr3-2qjg
nvd.nist.gov/vuln/detail/CVE-2023-37474

Detect and mitigate CVE-2023-37474 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →