CVE-2026-70657
Copyparty: file/dirkey confusion
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the containing folder. This vulnerability was only reachable if both types of keys (filekeys and dirkeys) were manually enabled in the volume flags simultaneously. This issue is fixed in version 1.20.17.
| CWE | CWE-863 |
| Vendor | 9001 |
| Product | copyparty |
| Published | Aug 18, 2026 |
| Last Updated | Aug 19, 2026 |
Stay Ahead of the Next One
Get instant alerts for 9001 copyparty
Be the first to know when new medium vulnerabilities affecting 9001 copyparty are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
9001 / copyparty
< 1.20.17