GHSA-x5pq-m9p8-f4vx: Medium severity pip/copyparty vulnerability
A valid filekey could potentially be converted into a dirkey, granting read-access to the containing folder.
This issue only affected volumes which simultaneously enable both filekeys and dirkeys, with volflag dk or dks combined with fk or fka.
Both required features are default-disabled, and must be explicitly enabled in the volflags (the "flags" section of a volume).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/copypartyto a version that resolves this vulnerability.Fixed in 1.20.17 - Configuration
Review all affected volumes and ensure the volume does not simultaneously enable both dirkeys and filekeys. Specifically, avoid combinations where volflag `dk` or `dks` is combined with `fk` or `fka` (this is the condition that was affected). If dirkeys and filekeys are not both required, explicitly disable one of them in the `flags` section (volflags).
Volume flags (volflags) dk = disable unless explicitly required - Configuration
For volumes currently using volflag `dks` together with `fk` or `fka`, explicitly disable `dks` or the corresponding filekey flag so both features are not enabled at the same time. The issue affected only volumes where both were enabled together (dks+fk or dks+fka).
Volume flags (volflags) dks = disable unless explicitly required
Event History
Frequently Asked Questions
Which deployments are exposed?
Only copyparty volumes configured with both filekeys and dirkeys are affected. This requires combining dk or dks with fk or fka in the volume flags; both feature sets are disabled by default.
What access does an attacker need, and what could they gain?
An attacker needs a valid filekey for a file in the target volume. They could potentially convert that filekey into a dirkey and gain read access to the folder containing the file.
What mitigation is available if patching must be delayed?
If immediate patching is not possible, remove either the filekey flags (fk or fka) or the dirkey flags (dk or dks) from affected volume configurations so they are not enabled together.
How can I determine whether a volume is affected?
Review each volume's flags configuration for dk or dks combined with fk or fka. Volumes without both categories enabled together are not affected.