EUVD-2026-60949
GHSA-x5pq-m9p8-f4vx
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
PR:L because a valid file key is required; C:L because only directory listing is exposed, not file contents; no integrity or availability impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
3DescriptionCVE.org
Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the containing folder even though both features are disabled by default and must be explicitly enabled in the volume flags. This issue is fixed in version 1.20.17.
AnalysisAI
File/directory key confusion in Copyparty before 1.20.17 allows an authenticated user holding a valid file key to escalate that key into a directory key, gaining unauthorized read access to the entire containing folder. The flaw stems from a missing guard in httpcli.py that unconditionally set the directory key flag even when a file key was active. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three simultaneous conditions: (1) the target Copyparty volume must have a directory-key volflag enabled (dk or dks), AND (2) the same volume must also have a file-key volflag enabled (fk or fka) - both are disabled by default and require explicit administrator configuration; (3) the attacker must possess a valid file key for at least one file on that volume (PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is low-to-moderate. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade copyparty to version 1.20.17 or later via pip (pip install --upgrade copyparty). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today