CVE-2023-37474

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Copyparty is a portable file server. Versions prior to 1.8.2 are subject to a path traversal vulnerability detected in the `.cpr` subfolder. The Path Traversal attack technique allows an attacker access to files, directories, and commands that reside outside the web document root directory. This issue has been addressed in commit `043e3c7d` which has been included in release 1.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
9001	copyparty	< 1.8.2
copyparty_project	copyparty	< 1.8.2

References

Timeline

Published: Jul 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-374757.5Hamba avro is a go lang encoder/decoder implementation of the avro codec specification. In affected versions a well-crafted string passed to CVE-2023-374767.8OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger CVE-2023-374778.81Panel is an open source Linux server operation and maintenance management panel. An OS command injection vulnerability exists in 1Panel fir CVE-2023-374789.8pnpm is a package manager. It is possible to construct a tarball that, when installed via npm or parsed by the registry is safe, but when in CVE-2023-374797.5Open Enclave is a hardware-agnostic open source library for developing applications that utilize Hardware-based Trusted Execution Environmen CVE-2023-37487.5A flaw was found in FRRouting when parsing certain babeld unicast hello messages that are intended to be ignored. This issue may allow an at CVE-2023-374804.9Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vuln CVE-2023-374814.9Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vuln CVE-2023-374825.3The login functionality of the web server in affected devices does not normalize the response times of login attempts. An unauthenticated re CVE-2023-374839.8SAP PowerDesigner - version 16.7, has improper access control which might allow an unauthenticated attacker to run arbitrary queries against CVE-2023-374845.3SAP PowerDesigner - version 16.7, queries all password hashes in the backend database and compares it with the user provided one during logi CVE-2023-374867.5Under certain conditions SAP Commerce (OCC API) - versions HY_COM 2105, HY_COM 2205, COM_CLOUD 2211, endpoints allow an attacker to access i