CVE-2026-104102 is a path traversal vulnerability in the FTP and FTPS server components of copyparty before version 1.20.19. It allows uploading files to any directory writable by the copyparty process when FTP or FTPS is explicitly enabled. The vulnerability does not allow reading or overwriting existing files, and filenames have randomized suffixes. It cannot be used to execute code directly via copyparty. The main risk is that uploaded files might affect other software on the same system if that software executes files in writable directories.
copyparty contains a volume restriction bypass vulnerability in its SFTP front end that allows authenticated SFTP users to create, remove, and truncate arbitrary paths outside permitted volume boundaries by exploiting three handlers that bypass the xvol volflag enforcement. The _mkdir, _rmdir, and _chattr handlers construct destination paths using vfs.get(), vn.canonical(), and os.path.join() without invoking the chk_ap access check, enabling attackers to traverse symlinks leaving a volume's top directory and perform unauthorized file creation, deletion, or truncation via SSH_FXP_SETSTAT operations on paths outside any volume the account is authorized to access.
CVE-2026-70657 is an incorrect authorization vulnerability in copyparty, a portable file server. Versions prior to 1.20.17 allow a combination of directory-key and file-key flags to convert a valid file key into a directory key, granting unintended read access to the containing folder. This issue requires manual enabling of both filekeys and dirkeys simultaneously. The vulnerability is fixed in version 1.20.17.
CVE-2026-32109 is a cross-site scripting (XSS) vulnerability in copyparty versions prior to 1.20.12. It arises when an attacker with both read and write permissions uploads a malicious . prologue.html file and crafts a link that executes arbitrary JavaScript unexpectedly. The vulnerability occurs because the server evaluates the . prologue.html file not only when accessed directly but also when accessed with certain query parameters, leading to unexpected script execution. Exploitation requires the victim to click a crafted link originating from the server itself, which limits the attack scope.
CVE-2026-32108 is an authorization vulnerability in copyparty versions prior to 1.20.12 affecting the shares feature when used with FTP or SFTP servers made publicly accessible. It allows an authenticated user browsing a shared single file via FTP/SFTP to guess or brute force sibling filenames in the same folder and gain unauthorized read access to those files. This vulnerability does not permit access to subdirectories and only applies under specific configurations involving the shares feature and FTP/SFTP protocols. It is similar to a previously fixed HTTP/HTTPS vulnerability but was not addressed for FTP until this fix. The CVSS score is low (2.3), reflecting limited impact and exploitation complexity. No known exploits are reported in the wild. The issue is fixed in copyparty version 1.
CVE-2026-30974 is a medium-severity cross-site scripting (XSS) vulnerability in copyparty versions prior to 1.20.11. The issue arises because the 'nohtml' configuration option, designed to block JavaScript execution in user-uploaded HTML files, did not apply to SVG images. This allows a user with write permissions to upload an SVG containing embedded JavaScript, which executes in the context of any user who opens the SVG file. Exploitation requires user interaction and write permissions but does not require elevated privileges beyond that. The vulnerability impacts confidentiality and integrity but not availability. It has been fixed in version 1.20.11.
Copyparty is a portable file server. In versions prior to 1.20.9, an XSS allows for reflected cross-site scripting via URL-parameter `?setck=...`. Version 1.20.9 fixes the issue.
Copyparty is a portable file server. In versions prior to 1.19.8, there was a missing permission-check in the shares feature (the `shr` global-option). When a share was created for just one file inside a folder, it was possible to access the other files inside that folder by guessing the filenames. It was not possible to descend into subdirectories in this manner; only the sibling files were accessible. This issue did not affect filekeys or dirkeys. Version 1.19.8 fixes the issue.
Copyparty is a portable file server. Versions prior to 1.18.9, the filter parameter for the "Recent Uploads" page allows arbitrary RegExes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks the server. This is fixed in version 1.18.9.
Copyparty is a portable file server. In versions 1.18.6 and below, when accessing the recent uploads page at `/?ru`, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which reflects its value directly into a `<script>` block without proper escaping, allowing for reflected Cross-Site Scripting (XSS) and can be exploited against both authenticated and unauthenticated users. This is fixed in version 1.18.7.
copyparty is a portable file server. In versions up to and including versions 1.18.4, an unauthenticated attacker is able to execute arbitrary JavaScript code in a victim's browser due to improper sanitization of multimedia tags in music files, including m3u files. This is fixed in version 1.18.5.