CVE-2026-70657
Copyparty: file/dirkey confusion
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the containing folder even though both features are disabled by default and must be explicitly enabled in the volume flags. This issue is fixed in version 1.20.17.
| CWE | CWE-863 |
| Vendor | 9001 |
| Product | copyparty |
| Published | Aug 18, 2026 |
Stay Ahead of the Next One
Get instant alerts for 9001 copyparty
Be the first to know when new medium vulnerabilities affecting 9001 copyparty are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
9001 / copyparty
< 1.20.17