Vulnerability PYSEC-2026-1279
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
3 months ago
July 07, 2026 at 04:03 PM UTC
copyparty: Sharing a single file does not fully restrict access to other files in source folder
0.2.3 - 1.19.7
0.2.3 - 1.19.7
Summary
copyparty: Sharing a single file does not fully restrict access to other files in source folder
Details
There was a missing permission-check in the shares feature (the shr global-option).
When a share is created for just one file inside a folder, it was possible to access the other files inside that folder by guessing the filenames.
It was not possible to descend into subdirectories in this manner; only the sibling files were accessible.
This issue did not affect filekeys or dirkeys.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
6 hours ago
copyparty FTP: upload outside defined volumes (limited path traversal)
0.2.3 - 1.20.18 GHSA-phv8-wgjp-g4p9
0.2.3 - 1.20.18 GHSA-phv8-wgjp-g4p9
Medium Risk
1 month ago
Copyparty vulnerable to file/dirkey confusion
0.2.3 - 1.20.16 PYSEC-2026-3660
0.2.3 - 1.20.16 PYSEC-2026-3660
Medium Risk
1 month ago
Copyparty vulnerable to file/dirkey confusion
0.2.3 - 1.20.16 GHSA-x5pq-m9p8-f4vx
0.2.3 - 1.20.16 GHSA-x5pq-m9p8-f4vx
High Risk
3 months ago
copyparty allows Regex Denial of Service (ReDoS) in the upload listing
0.2.3 - 1.18.8 PYSEC-2026-1275
0.2.3 - 1.18.8 PYSEC-2026-1275
Medium Risk
3 months ago
copyparty Reflected XSS via Filter Parameter
0.2.3 - 1.18.6 PYSEC-2026-1276
0.2.3 - 1.18.6 PYSEC-2026-1276
Impacted packages
Timeline
Published
3 months ago
July 07, 2026 at 04:03 PM UTC
Fixed (1.19.8)
1 year ago
September 07, 2025 at 11:01 PM UTC
Last Modified
3 months ago
July 07, 2026 at 05:47 PM UTC