CVE-2026-70657Medium· 4.3▾ SunlitCopyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the conta…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the containing folder. This vulnerability was only reachable if both types of keys (filekeys and dirkeys) were manually enabled in the volume flags simultaneously. This issue is fixed in version 1.20.17.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
copyparty < 1.20.17Patched in:
copyparty 1.20.17Connected by shared product, vendor, weakness, or advisory.
CVE-2023-37474High· 7.5copyparty vulnerable to path traversal attack
CVE-2023-41471High· 7.8Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to t…
CVE-2026-30974Medium· 4.6copyparty: volflag `nohtml` did not block javascript in svg files
CVE-2026-27948Medium· 5.4Copyparty vulnerable to reflected XSS via setck parameter
CVE-2025-58753Mediumcopyparty: Sharing a single file does not fully restrict access to other files in source folder
CVE-2025-27145Low· 3.6copyparty renders unsanitized filenames as HTML when user uploads empty files