Description

Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the containing folder even though both features are disabled by default and must be explicitly enabled in the volume flags. This issue is fixed in version 1.20.17.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-18T15:17:01.077Z",
  "pubdate": "2026-08-18T15:17:01.077Z",
  "executiveSummary": "An access control vulnerability exists in the Copyparty portable file server prior to version 1.20.17, specifically concerning the interaction of volume configuration flags. The vulnerability stems from improper handling of directory-key and file-key mechanisms, allowing a valid file key to be improperly converted into a directory key. When volumes are configured with the dk or dks directory-key flags combined with the fk or fka file-key flags, an unauthorized actor capable of acquiring a legitimate file key can leverage this cryptographic or logical flaw to gain unintended read access to the entire containing folder. Although both the directory-key and file-key features are disabled by default and require explicit administrative enablement within the volume flags, their concurrent usage creates a severe authorization bypass condition. The risk implications include the potential exposure of sensitive directory contents to users who should only possess scoped access to individual files. Successful exploitation requires the targeted volume to have the specific vulnerable flag combinations explicitly enabled by an administrator, and the attacker must possess a valid file key to initiate the key conversion process.",
  "technicalDetails": "The vulnerability resides within the authorization and key-mapping components of Copyparty affecting versions prior to 1.20.17. The root cause is an insecure logical implementation in how access keys are parsed and validated when both directory-level keys (configured via the dk or dks volume flags) and file-level keys (configured via the fk or fka volume flags) are simultaneously active on a given volume. Under normal operations, these keys are intended to enforce granular access control boundaries, segregating file access from broader directory enumeration and retrieval. However, the flaw allows the validation routines to improperly interpret or coerce a valid file key into functioning as a directory key. The attack flow initiates when an adversary obtains a legitimate file key associated with a specific resource within the vulnerable volume. By presenting this file key to the server in a context that triggers the flawed key-processing logic—specifically exploiting the coexistence of the dk/dks and fk/fka configurations—the application fails to strictly enforce the intended scoping constraints. Consequently, the server maps the supplied file key to the broader directory scope, granting the requestor unauthorized read access to the containing folder. The vulnerable component is network-exposed as part of the Copyparty HTTP file server functionality. The exploitation requires no authentication other than possession of a valid file key, operating under the privilege context granted by the improperly elevated key capabilities. The post-exploitation impact includes unauthorized directory traversal and enumeration of sensitive file assets residing in the parent directory structure that should have remained partitioned."
}