Vulnerability PYSEC-2026-3660
Medium Risk
MEDIUM RISK
CVSS Score: 4.3
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
1 month ago
August 19, 2026 at 11:56 AM UTC
Copyparty vulnerable to file/dirkey confusion
0.2.3 - 1.20.16
0.2.3 - 1.20.16
Summary
Copyparty vulnerable to file/dirkey confusion
Details
A valid filekey could potentially be converted into a dirkey, granting read-access to the containing folder.
This issue only affected volumes which simultaneously enable both filekeys and dirkeys, with volflag dk or dks combined with fk or fka.
Both required features are default-disabled, and must be explicitly enabled in the volflags (the "flags" section of a volume).
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
6 hours ago
copyparty FTP: upload outside defined volumes (limited path traversal)
0.2.3 - 1.20.18 GHSA-phv8-wgjp-g4p9
0.2.3 - 1.20.18 GHSA-phv8-wgjp-g4p9
Medium Risk
1 month ago
Copyparty vulnerable to file/dirkey confusion
0.2.3 - 1.20.16 GHSA-x5pq-m9p8-f4vx
0.2.3 - 1.20.16 GHSA-x5pq-m9p8-f4vx
Unknown
3 months ago
copyparty: Sharing a single file does not fully restrict access to other files in source folder
0.2.3 - 1.19.7 PYSEC-2026-1279
0.2.3 - 1.19.7 PYSEC-2026-1279
High Risk
3 months ago
copyparty allows Regex Denial of Service (ReDoS) in the upload listing
0.2.3 - 1.18.8 PYSEC-2026-1275
0.2.3 - 1.18.8 PYSEC-2026-1275
Medium Risk
3 months ago
copyparty Reflected XSS via Filter Parameter
0.2.3 - 1.18.6 PYSEC-2026-1276
0.2.3 - 1.18.6 PYSEC-2026-1276
Impacted packages
Timeline
Published
1 month ago
August 19, 2026 at 11:56 AM UTC
Fixed (1.20.17)
3 months ago
July 06, 2026 at 07:42 PM UTC
Last Modified
1 month ago
August 19, 2026 at 12:45 PM UTC