CVE-2023-37474: Copyparty path traversal in .cpr subfolder exposes files outside web root

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityHigh confidentiality impact, unauthenticated network reachability and a high EPSS percentile with a public exploit-tagged advisory make this a high priority despite no KEV listing.

What it is

Copyparty versions before 1.8.2 contain a path traversal flaw in the .cpr subfolder, allowing access to files, directories and commands outside the web document root. The issue is fixed in commit 043e3c7d, included in release 1.8.2, and no workarounds exist, so upgrading is the only remedy.

Impact

An unauthenticated remote attacker can read files outside the intended document root, potentially exposing configuration, credentials or other sensitive data on the host. The CVSS vector shows high confidentiality impact with no integrity or availability effect.

Attack surface

Reachable over the network via HTTP requests to the .cpr subfolder; the CVSS vector AV:N/AC:L/PR:N/UI:N indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV and no ransomware usage documented, but EPSS is 0.4492 (98.7th percentile) and a public advisory is tagged Exploit, indicating meaningful exploitation likelihood.

What to do

• Upgrade Copyparty to version 1.8.2 or later, which includes the fix commit 043e3c7d.
• If immediate upgrade is impossible, restrict network access to the Copyparty service to trusted clients only.
• Block or filter requests targeting the .cpr subfolder at the reverse proxy or WAF.
• Run Copyparty with least-privilege filesystem permissions so traversal reads cannot reach sensitive files.
• Monitor vendor advisory GHSA-pxfv-7rr3-2qjg for any updated guidance.

Detection

• Search HTTP access logs for requests containing .cpr with traversal sequences such as ../ or encoded variants.
• Alert on requests to .cpr paths returning 200 responses for files outside the expected document root.
• Review filesystem access logs for reads of sensitive files by the Copyparty process user.
• Correlate outbound or local file reads by the Copyparty service with unusual client IPs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.