Directory Key Conversion Vulnerability in Copyparty File Server

CVE-2026-70657

What is CVE-2026-70657?

A security flaw in Copyparty allows for the unintended conversion of valid file keys into directory keys when specific flags are set. This flaw can inadvertently grant read access to sensitive directories. This behavior occurs even though the pertinent features are disabled by default and require explicit activation through volume flags. The issue, identified in versions prior to 1.20.17, highlights a significant risk to data confidentiality. The vulnerability has been addressed in version 1.20.17, and users are urged to update to mitigate potential unauthorized access.

References