CVE-2026-70657: Copyparty Auth Bypass Vulnerability

CVE-2026-70657 Overview

Copyparty is a portable file server written in Python. A broken access control flaw ([CWE-863]) in versions prior to 1.20.17 allows a user holding a valid file key to convert it into a directory key. The conversion grants read access to the entire containing folder, bypassing the intended per-file authorization boundary.

The issue only surfaces when both the directory-key flags (dk or dks) and the file-key flags (fk or fka) are enabled simultaneously in the same volume configuration. The project maintainer fixed the flaw in copyparty version 1.20.17.

Critical Impact
An authenticated user with knowledge of a single file key can enumerate and read every file in the parent directory when both key types are enabled on the same volume.

Affected Products

copyparty versions prior to 1.20.17
Deployments using volume flag combinations of dk/dks with fk/fka
Portable file server instances distributed via the copyparty GitHub repository

Discovery Timeline

2026-08-18 - CVE-2026-70657 published to NVD
2026-08-19 - Last updated in NVD database
v1.20.17 - Fix released via copyparty release v1.20.17

Technical Details for CVE-2026-70657

Vulnerability Analysis

Copyparty issues cryptographic keys to gate access to individual files (file keys, fk) or entire directories (directory keys, dk). These two mechanisms are intended to operate independently. When a volume enabled both feature sets, the request handling logic in httpcli.py set the add_dk variable based solely on the dk volume flag, without checking whether the request was already authenticated by a file key.

As a result, a user presenting a valid file key was treated as if they also possessed the directory key. The server then returned a directory listing and permitted read access to sibling files that the user was never authorized to see. The confidentiality boundary between files in the same folder collapsed.

Root Cause

The root cause is an incorrect authorization decision ([CWE-863]) in the file listing path. The server did not distinguish between an authorization context established by a file key and one established by a directory key. The patch introduces a use_filekey guard that suppresses the directory-key path when the current request is authorized only by a file key.

Attack Vector

The attack is remote and requires low privileges. An attacker who receives or discovers a shared file-key URL for a protected volume can substitute the key into a directory listing request. The server treats the file key as a valid directory key and returns folder contents.

python

            else:
                ls_names = exclude_dotfiles(ls_names)

-        add_dk = vf.get("dk")
+        add_dk = not use_filekey and vf.get("dk")
         add_fk = vf.get("fk")
         fk_alg = 2 if "fka" in vf else 1
         if add_dk:

Source: copyparty commit e40755331ba9449993ff482456e6bdd2c6deb950. The patch adds the not use_filekey condition so that file-key requests can no longer trigger directory-key behavior.

Detection Methods for CVE-2026-70657

Indicators of Compromise

Access log entries showing directory listing requests that carry a URL parameter matching a known file-key pattern rather than a directory-key pattern.
Sequential requests from the same client that first fetch a specific file and then enumerate the parent directory using the same key value.
Reads of files that the client's file-key URL never referenced directly.

Detection Strategies

Audit copyparty volume configurations for volumes where both dk/dks and fk/fka flags are set together.
Correlate HTTP request logs to identify clients accessing multiple distinct files in a folder using a single reused key.
Compare the version string returned by the running copyparty instance against 1.20.17 to identify unpatched hosts.

Monitoring Recommendations

Enable verbose access logging on copyparty and forward logs to a centralized analytics platform for retention and query.
Alert on directory listing responses served to clients whose only prior activity was single-file downloads.
Track outbound data volume per key value to identify keys that suddenly exfiltrate more content than a single file could contain.

How to Mitigate CVE-2026-70657

Immediate Actions Required

Upgrade copyparty to version 1.20.17 or later on every host running the file server.
Inventory all copyparty volume definitions and identify those that combine directory-key and file-key flags.
Rotate any file keys or directory keys that were shared while a vulnerable version was in production.

Patch Information

The fix is committed in copyparty commit e40755331ba9449993ff482456e6bdd2c6deb950 and shipped in the copyparty v1.20.17 release. Full remediation details are documented in GitHub Security Advisory GHSA-x5pq-m9p8-f4vx.

Workarounds

Remove either the directory-key flags (dk, dks) or the file-key flags (fk, fka) from any volume that currently uses both, until the upgrade is complete.
Restrict volume access to trusted network segments using a reverse proxy or firewall rules while patching is scheduled.
Revoke and reissue keys after upgrading to invalidate any keys that may have been shared under the vulnerable configuration.

bash

# Verify the running copyparty version
python3 -m copyparty --version

# Upgrade via pip
pip install --upgrade 'copyparty>=1.20.17'

# Temporary workaround: disable directory keys on a volume
# by removing dk/dks flags from the volume definition, e.g.:
# -v /srv/share:share:r:c,fk    # keep file keys only