CVE-2026-70657CWE-863broken-access-control

CVE-2026-70657

Medium · published August 18, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
25.0
In the wild
Unconfirmed
What it is

Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the containing folder. This vulnerability was only reachable if both types of keys (filekeys and dirkeys) were manually enabled in the volume flags simultaneously. This issue is fixed in version 1.20.17.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00331 · 25.0th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-08-18T19:17Z
References (3)
https://github.com/9001/copyparty/commit/e40755331ba9449993ff482456e6bdd2c6deb950 · [email protected]https://github.com/9001/copyparty/releases/tag/v1.20.17 · [email protected]https://github.com/9001/copyparty/security/advisories/GHSA-x5pq-m9p8-f4vx · [email protected]
EPSS history
Timeline
  • 18 AUG 14:59Z
    Copyparty: file/dirkey confusion
    cvelistv5