CVE-2025-58753: copyparty: Sharing a single file does not fully restrict access to other files in source folder
Copyparty is a portable file server. In versions prior to 1.19.8, there was a missing permission-check in the shares feature (the shr global-option). When a share was created for just one file inside a folder, it was possible to access the other files inside that folder by guessing the filenames. It was not possible to descend into subdirectories in this manner; only the sibling files were accessible. This issue did not affect filekeys or dirkeys. Version 1.19.8 fixes the issue.
Other sources
There was a missing permission-check in the shares feature (the shr global-option).
When a share is created for just one file inside a folder, it was possible to access the other files inside that folder by guessing the filenames.
It was not possible to descend into subdirectories in this manner; only the sibling files were accessible.
This issue did not affect filekeys or dirkeys.
— GitHub
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-58753?
CVE-2025-58753 is considered a moderate severity vulnerability due to the risk of unauthorized file access.
How do I fix CVE-2025-58753?
To fix CVE-2025-58753, upgrade to copyparty version 1.19.8 or later.
What type of vulnerability is CVE-2025-58753?
CVE-2025-58753 is a missing permission-check vulnerability related to the shares feature in copyparty.
Can CVE-2025-58753 lead to data exposure?
Yes, CVE-2025-58753 can lead to data exposure by allowing unauthorized users to guess filenames and access files.
Is there a workaround for CVE-2025-58753?
There is no official workaround for CVE-2025-58753; upgrading to the patched version is the recommended action.