Read the docs
TI-2026-24646 Aliases CVE-2026-32108GHSA-67rw-2x62-mqqm

Copyparty ftp/sftp: Sharing a single file did not fully restrict source-folder access

Priority LOW 12CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

Copyparty is a portable file server. Prior to 1.20.12, there was a missing permission-check in the shares feature (the shr global-option). This vulnerability only applies when the shares feature is used for the specific purpose of creating a share of just a single file inside a folder or either the FTP or SFTP server is enabled, and also made publicly accessible. Given these conditions, when a user is browsing a share through either FTP or SFTP (not http or https), they can gain read-access to the remaining files inside the shared folder by guessing/bruteforcing the filenames. It was not possible to descend into subdirectories in this manner; only the sibling files were accessible. This vulnerability is similar to CVE-2025-58753 which was previously fixed for HTTP and HTTPS, but not for FTP. The FTPS server did not yet exist at that time. This vulnerability is fixed in 1.20.12.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00309 23rd percentileScored 2026-11-07
Fix Fixed copyparty (9001): 1.20.12copyparty (PyPI): 1.20.12

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
9001copypartybefore 1.20.121.20.12Patch availableCNA
—copyparty (PyPI)before 1.20.121.20.12Patch availableGHSA-67rw-2x62-mqqm
  • copyparty Vendor9001 Affected before 1.20.12 Fixed in 1.20.12 Patch available CNA
  • copyparty (PyPI) Vendor— Affected before 1.20.12 Fixed in 1.20.12 Patch available GHSA-67rw-2x62-mqqm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:9001:copyparty:*:*:*:*:*:*:*:*before 1.20.12Vulnerable9001
  • cpe:2.3:a:9001:copyparty:*:*:*:*:*:*:*:* Versions before 1.20.12 Vulnerable ·9001

Remediation

  • Fix · CNA copyparty (9001) Fixed in 1.20.12
  • Fix · GHSA-67rw-2x62-mqqm copyparty (PyPI) Fixed in 1.20.12 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-32108
  2. 2026-10-03 Alias added: GHSA-67rw-2x62-mqqm

References

Advisory 2

Other 2

  • TI-2025-34551 Copyparty is vulnerable to Regex Denial of Service (ReDoS) attacks through "Recent Uploads" page CVSS 3.1HIGH 7.5
  • TI-2023-19082 Path traversal in copyparty CVSS 3.1HIGH 7.5
  • TI-2023-21990 Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to… CVSS 3.1HIGH 7.8
  • TI-2023-19881 copyparty vulnerable to reflected cross-site scripting via k304 parameter CVSS 3.1MEDIUM 6.3
  • TI-2025-34228 copyparty has a DOM-Based XSS vulnerability when displaying multimedia metadata CVSS 3.1MEDIUM 6.1
  • TI-2025-20002 copyparty renders unsanitized filenames as HTML when user uploads empty files CVSS 3.1MEDIUM 6.1
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences