Copyparty: file/dirkey confusion

Description

Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the containing folder. This vulnerability was only reachable if both types of keys (filekeys and dirkeys) were manually enabled in the volume flags simultaneously. This issue is fixed in version 1.20.17.

Scores

EPSS (exploitation in 30 days)

0.33% · top 74% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.

Weakness

• CWE-863: Incorrect Authorization (opens in a new tab)All about CWE-863 and its CVEs

Affected products

• 9001 · copyparty

  • affected < 1.20.17

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• PyPIcopypartyGHSA-x5pq-m9p8-f4vx (opens in a new tab)

References (3)

• https://github.com/9001/copyparty/security/advisories/GHSA-x5pq-m9p8-f4vx (opens in a new tab)x_refsource_CONFIRM
• https://github.com/9001/copyparty/commit/e40755331ba9449993ff482456e6bdd2c6deb950 (opens in a new tab)x_refsource_MISC
• https://github.com/9001/copyparty/releases/tag/v1.20.17 (opens in a new tab)x_refsource_MISC

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-x5pq-m9p8-f4vx (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-70657](https://trackcve.app/badge/CVE-2026-70657.svg)](https://trackcve.app/cve/CVE-2026-70657)

Record last updated 19 Aug 2026, 16:19 UTC.