CVE-2026-70657 in Copyparty
Summary
by MITRE • 08/18/2026
Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the containing folder even though both features are disabled by default and must be explicitly enabled in the volume flags. This issue is fixed in version 1.20.17.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
Copyparty is designed as a portable file server that allows users to host files via HTTP with various access controls, including encryption at rest through directory keys and file-specific keys. The vulnerability identified involves an interaction between the dk or dks flags, which enable directory-level key authentication, and the fk or fka flags, which enforce file-level key requirements. In versions prior to 1.20.17, a logic flaw exists in how these two distinct security mechanisms are validated during request processing. Specifically, when both features are explicitly enabled for a given volume, an attacker can supply a valid file-specific encryption key that is intended only for accessing individual files within the directory structure.
The core technical flaw lies in the server's failure to strictly differentiate between context-dependent keys after initial validation. Instead of verifying that the provided key matches the specific scope required by the requested resource type, the system accepts any valid cryptographic token associated with the volume if it successfully decrypts a file request. This allows an attacker who possesses or can guess a valid file key for one item within a protected directory to use that same key as proof of authentication when attempting to list the contents of the parent folder. Consequently, the server grants read access to the entire containing directory, bypassing the intended isolation enforced by the dk flag which should require a separate, distinct directory-level secret.
This vulnerability represents an authorization bypass where proper separation of duties between file-level and directory-level security contexts is not maintained. From a classification perspective, this aligns with CWE-284 Improper Access Control because the application fails to restrict access to resources based on user privileges or context-specific credentials. Furthermore, it relates to CWE-601 URL Redirection to Untrusted Site in terms of logic flow errors where input validation is insufficient for the specific operational context. In the MITRE ATT&CK framework, this behavior facilitates lateral movement and discovery within a compromised environment by allowing an attacker with limited file-level access to enumerate directory structures, potentially leading to further exploitation or data exfiltration through broader reconnaissance.
The impact of this flaw is significant for deployments that rely on fine-grained encryption controls. While both the dk/dks and fk/fka features are disabled by default, organizations that have explicitly enabled these settings to secure sensitive data against unauthorized access face a direct risk of information disclosure. An attacker with knowledge of any single file key within an encrypted directory can expand their scope from reading one specific document to browsing all files in that folder. This undermines the confidentiality guarantees provided by the encryption layer and exposes metadata, filenames, and potentially other protected content stored alongside the initially accessed file.
To mitigate this risk, administrators must upgrade Copyparty to version 1.20.17 or later immediately upon deployment if these features are active. The updated release corrects the validation logic to ensure that directory keys cannot be substituted with valid file keys for administrative operations such as listing directories. Additionally, until an upgrade is performed in environments where patching is delayed, it is advisable to review access logs for unusual patterns of requests using identical cryptographic tokens across different resource types within the same volume. Implementing strict network-level firewalls and ensuring that only authorized IP ranges can reach the Copyparty instance also reduces the attack surface available to potential exploiters seeking to leverage this logic error.