CVE-2026-70657: Copyparty: file/dirkey confusion
A valid filekey could potentially be converted into a dirkey, granting read-access to the containing folder.
This issue only affected volumes which simultaneously enable both filekeys and dirkeys, with volflag dk or dks combined with fk or fka.
Both required features are default-disabled, and must be explicitly enabled in the volflags (the "flags" section of a volume).
Other sources
Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the containing folder even though both features are disabled by default and must be explicitly enabled in the volume flags. This issue is fixed in version 1.20.17.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/copypartyto a version that resolves this vulnerability.Fixed in 1.20.17 - Upgrade
Upgrade
copypartyto a version that resolves this vulnerability.Fixed in 1.20.17
Event History
Frequently Asked Questions
Which Copyparty configurations are affected?
Only volumes explicitly configured with both a directory-key flag (dk or dks) and a file-key flag (fk or fka) are affected. These features are disabled by default, so installations that have not enabled both flags on the same volume are not exposed by this issue.
What does an attacker need to exploit this issue?
An attacker needs a valid file key for a file in an affected volume. They can use that file key as a directory key to obtain read access to the folder containing the file.
What mitigation is available if patching cannot happen immediately?
Upgrade Copyparty to version 1.20.17. If an immediate upgrade is not possible, remove either the dk/dks directory-key flag or the fk/fka file-key flag from affected volume configurations so the two feature types are not enabled together.