{"id":"CVE-2025-58753","aliases":["GHSA-pxvw-4w88-6x95","PYSEC-2026-1279"],"title":"copyparty: Sharing a single file does not fully restrict access to other files in source folder","summary":"copyparty: Sharing a single file does not fully restrict access to other files in source folder","severity":"medium","vendor":"copyparty","product":"copyparty","ecosystem":"pip","affected":["copyparty < 1.19.8"],"patched":["copyparty 1.19.8"],"published":"2025-09-09","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-pxvw-4w88-6x95","references":[{"url":"https://github.com/9001/copyparty/security/advisories/GHSA-pxvw-4w88-6x95"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58753"},{"url":"https://github.com/9001/copyparty/commit/e0a92ba72d46074209a9c304eb2a01ca0429e60c"},{"url":"https://github.com/9001/copyparty"},{"url":"https://github.com/9001/copyparty/releases/tag/v1.19.8"}],"tags":["osv","pip"],"epss":0.00369,"epssPercentile":0.30731,"ingestedAt":"2026-07-08T18:25:52.046Z","slug":"CVE-2025-58753","body":"## Overview\n\nThere was a missing permission-check in the shares feature (the `shr` global-option).\n\nWhen a share is created for just one file inside a folder, it was possible to access the other files inside that folder by guessing the filenames.\n\nIt was not possible to descend into subdirectories in this manner; only the sibling files were accessible.\n\nThis issue did not affect filekeys or dirkeys.\n\n## Affected packages\n\n- `copyparty < 1.19.8`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `copyparty 1.19.8`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}