Copyparty is a portable file server that prior to version 1.20.12 contained an incorrect authorization vulnerability (CWE-863) identified as CVE-2026-32108. This flaw arises from a missing permission check in the shares feature's 'shr' global option when creating a share of a single file inside a folder. The vulnerability manifests only if the FTP or SFTP server is enabled and publicly accessible, and the share is accessed through FTP or SFTP protocols (not HTTP/HTTPS). Under these conditions, an authenticated user browsing the shared single file can enumerate sibling files in the same directory by guessing or brute forcing filenames, thereby gaining unauthorized read access to these files. The vulnerability does not allow traversal into subdirectories, limiting exposure to sibling files only. This issue is analogous to CVE-2025-58753, which was previously fixed for HTTP/HTTPS but not for FTP. At the time, FTPS was not implemented, so it was not affected. The vulnerability has a CVSS 4.0 base score of 2.3, indicating low severity due to limited impact and the requirement for at least low privileges and authentication. No known exploits have been reported in the wild. The vulnerability is resolved in copyparty version 1.20.12 by adding the necessary permission checks for FTP and SFTP shares.

The primary impact of CVE-2026-32108 is unauthorized disclosure of files within a shared folder on copyparty servers configured with FTP or SFTP and publicly accessible shares of single files. Attackers with authenticated access to a shared file can enumerate and read sibling files by guessing filenames, potentially exposing sensitive or confidential information. However, the inability to access subdirectories limits the scope of data exposure. Since exploitation requires the shares feature to be used in a specific way and FTP/SFTP to be publicly accessible, the attack surface is relatively narrow. Organizations using copyparty for public file sharing over FTP/SFTP may face data leakage risks if they have not updated to version 1.20.12. The vulnerability does not allow modification or deletion of files, nor does it affect availability, so integrity and availability impacts are minimal. Overall, the risk is low but could be significant if sensitive files are exposed in shared folders accessible via FTP/SFTP.

To mitigate CVE-2026-32108, organizations should immediately upgrade copyparty to version 1.20.12 or later, where the missing permission checks have been implemented. If upgrading is not immediately feasible, administrators should disable the shares feature or avoid sharing single files within folders when using FTP or SFTP servers. Restrict FTP and SFTP access to trusted networks or authenticated users only, and avoid making these services publicly accessible. Implement strong filename policies and monitoring to detect brute force or enumeration attempts on shared folders. Additionally, consider disabling FTP/SFTP if HTTP/HTTPS sharing suffices, as the vulnerability does not affect those protocols post prior fixes. Regularly audit shared folder configurations and access logs to identify unauthorized access attempts. Employ network segmentation and firewall rules to limit exposure of copyparty servers to untrusted networks.