CVE-2026-70657

Published: Aug 18, 2026Modified: Aug 19, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the containing folder. This vulnerability was only reachable if both types of keys (filekeys and dirkeys) were manually enabled in the volume flags simultaneously. This issue is fixed in version 1.20.17.

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (3)

https://github.com/9001/copyparty/commit/e40755331ba9449993ff482456e6bdd2c6deb950

Source: security-advisories@github.com

https://github.com/9001/copyparty/releases/tag/v1.20.17

Source: security-advisories@github.com

https://github.com/9001/copyparty/security/advisories/GHSA-x5pq-m9p8-f4vx

Source: security-advisories@github.com

Timeline

No history available yet.