GitHub Advisoryadvisory · PyPI
GHSA-x5pq-m9p8-f4vx Copyparty vulnerable to file/dirkey confusion
MEDIUM
Official page ↗
- Aliases
- CVE-2026-70657
- Ecosystem
- PyPI
- Packages
- copyparty
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-863
- Reviewed
- 2026-08-18
Affected packages
• PyPI copyparty: < 1.20.17 → fixed in 1.20.17
Description
A valid filekey could potentially be converted into a dirkey, granting read-access to the containing folder.
This issue only affected volumes which simultaneously enable both filekeys and dirkeys, with volflag `dk` or `dks` combined with `fk` or `fka`.
Both required features are default-disabled, and must be explicitly enabled in the volflags (the "flags" section of a volume).
Related
Alias · CVE (1)
- CVE-2026-70657 Copyparty is a portable file server. vulnerability
Weakness · CWE (1)
- CWE-863 Incorrect Authorization weakness