Copyparty vulnerable to file/dirkey confusion
A valid filekey could potentially be converted into a dirkey, granting read-access to the containing folder. This issue only affected volumes which simultaneously enable both filekeys and dirkeys, with volflag `dk` or `dks` combined with `fk` or `fka`. Both required features are default-disabled, and must be explicitly enabled in the volflags (the "flags" section of a volume).
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-70657US | —OT elevated | — | ||
Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file ke… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/9001/copypartyPACKAGE
- https://github.com/9001/copyparty/commit/e40755331ba9449993ff482456e6bdd2c6deb950WEB
- https://github.com/9001/copyparty/releases/tag/v1.20.17WEB
- https://github.com/9001/copyparty/security/advisories/GHSA-x5pq-m9p8-f4vxWEB
- https://github.com/advisories/GHSA-x5pq-m9p8-f4vxADVISORY
- https://nvd.nist.gov/vuln/detail/CVE-2026-70657ADVISORY
- https://pypi.org/project/copypartyPACKAGE
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan