Every CVE Search/ Get API key

CVE-2026-70657

Copyparty: file/dirkey confusion

4.3 MediumFix available

Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the containing folder. This vulnerability was only reachable if both types of keys (filekeys and dirkeys) were manually enabled in the volume flags simultaneously. This issue is fixed in version 1.20.17.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.33%Unchanged since Aug 19, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.3

Copyparty: file/dirkey confusion

Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the containing folder. This vulnerability was only reachable if both types of keys (filekeys and dirkeys) were manually enabled in the volume flags simultaneously. This issue is fixed in version 1.20.17.

Record
CVE-2026-70657
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-863
Updated
2026-11-02
EUVDEUVD-2026-60949 4.3

Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the containing folder. This vulnerability was only reachable if both types of keys (filekeys and dirkeys) were manually enabled in the volume flags simultaneously. This issue is fixed in version 1.20.17.

Record
EUVD-2026-60949
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-x5pq-m9p8-f4vx 4.3

Copyparty vulnerable to file/dirkey confusion

A valid filekey could potentially be converted into a dirkey, granting read-access to the containing folder.

This issue only affected volumes which simultaneously enable both filekeys and dirkeys, with volflag dk or dks combined with fk or fka.

Both required features are default-disabled, and must be explicitly enabled in the volflags (the "flags" section of a volume).

Record
GHSA-x5pq-m9p8-f4vx
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-863
Updated
2026-11-02
NVD 4.3

Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the containing folder. This vulnerability was only reachable if both types of keys (filekeys and dirkeys) were manually enabled in the volume flags simultaneously. This issue is fixed in version 1.20.17.

Record
CVE-2026-70657
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-863
Updated
2026-11-02
OSV 4.3

Copyparty: file/dirkey confusion

Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the containing folder. This vulnerability was only reachable if both types of keys (filekeys and dirkeys) were manually enabled in the volume flags simultaneously. This issue is fixed in version 1.20.17.

Record
CVE-2026-70657
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-863
Updated
2026-11-02
OSVGHSA-x5pq-m9p8-f4vx 4.3

Copyparty vulnerable to file/dirkey confusion

A valid filekey could potentially be converted into a dirkey, granting read-access to the containing folder.

This issue only affected volumes which simultaneously enable both filekeys and dirkeys, with volflag dk or dks combined with fk or fka.

Both required features are default-disabled, and must be explicitly enabled in the volflags (the "flags" section of a volume).

Record
GHSA-x5pq-m9p8-f4vx
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-863
Updated
2026-11-02
OSVPYSEC-2026-3660 4.3

Copyparty vulnerable to file/dirkey confusion

A valid filekey could potentially be converted into a dirkey, granting read-access to the containing folder.

This issue only affected volumes which simultaneously enable both filekeys and dirkeys, with volflag dk or dks combined with fk or fka.

Both required features are default-disabled, and must be explicitly enabled in the volflags (the "flags" section of a volume).

Record
PYSEC-2026-3660
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
copyparty
PyPI
 before 1.20.17
1.20.17
copyparty
PyPI
 before 1.20.17, plus listed versions
0.10.00.10.10.10.100.10.110.10.12
Show 45 moreShow less
0.10.130.10.140.10.150.10.160.10.170.10.180.10.190.10.20.10.200.10.210.10.220.10.30.10.40.10.50.10.60.10.70.10.80.10.90.11.00.11.10.11.100.11.110.11.120.11.130.11.140.11.150.11.160.11.170.11.180.11.190.11.200.11.210.11.220.11.230.11.240.11.260.11.270.11.280.11.290.11.300.11.310.11.320.11.330.11.340.11.35
1.20.17

History

History
RecordedChangedSources
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-70657 is a medium vulnerability (CVSS 4.3) in 9001 Copyparty, published August 18, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in copyparty 1.20.17.

References

This page doesn't list everything

Left out here: 323 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open