CVE-2026-70657: Logical Authorization Bypass in Copyparty Directory and File Key Handling

Vulnerability ID: CVE-2026-70657
CVSS Score: 4.3
Published: 2026-08-18

A logical authorization bypass vulnerability in copyparty allows an attacker possessing a restricted file-level key to escalate privileges to directory-level access, exposing directory listings and adjacent files.

TL;DR

Copyparty is vulnerable to a privilege escalation vulnerability where a valid file key can be elevated to a directory key, allowing unauthorized directory listings and access to adjacent files when directory-key (dk) and file-key (fk) flags are enabled simultaneously.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-863
Attack Vector: Network
CVSS Score: 4.3 (Medium)
Exploit Status: PoC
KEV Status: Not Listed
Affected Function: tx_browser in copyparty/httpcli.py

Affected Systems

Copyparty File Server
copyparty: < 1.20.17 (Fixed in: 1.20.17)

Code Analysis

Commit: e407553

Fix directory-key logic elevation when file keys are actively used within browser request contexts

Mitigation Strategies

Upgrade Copyparty installations to v1.20.17 or later.
Isolate and separate configurations so directory-key (dk) and file-key (fk) flags are not combined on the same volume.
Deploy WAF rules to inspect and block directory index requests that include file-key parameters.

Remediation Steps:

Identify all copyparty deployments in the inventory running versions prior to v1.20.17.
Inspect configuration files (such as volume flags) for occurrences where both 'dk'/'dks' and 'fk'/'fka' are set.
For temporary mitigation, remove either the file-key or directory-key flag from the shared volumes.
Apply the official update using the system package manager or pull the v1.20.17 container image.
Verify access separation by attempting to traverse to parent directories using an isolated file key.