Copyparty ftp/sftp: Sharing a single file did not fully restrict source-folder access
There was a missing permission-check in the shares feature (the shr global-option).
This vulnerability only applies in the following scenario:
- The shares feature is used for the specific purpose of creating a share of just a single file inside a folder
- Either the FTP or SFTP server is enabled, and also made publically accessible
- If a share is password-protected, then SFTP was not vulnerable unless the
sftp-pwglobal-option was also enabled
- If a share is password-protected, then SFTP was not vulnerable unless the
Given these conditions, when a user is browsing a share through either FTP or SFTP (not http or https), they can gain read-access to the remaining files inside the shared folder by guessing/bruteforcing the filenames.
It was not possible to descend into subdirectories in this manner; only the sibling files were accessible.
This issue did not affect filekeys or dirkeys.
This vulnerability is CVE-2025-58753 which was previously fixed for HTTP and HTTPS, but not for FTP. The FTPS server did not yet exist at that time.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | copyparty | < 1.20.12 | 1.20.12 |
Referencias
- Vector CVSS
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N- Debilidad (CWE)
CWE-863- Plataforma
- Python (PyPI)
- Paquete
copyparty- Publicada
- 11.03.2026
- Actualizado
- 11.10.2026 12:19
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2026-31 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-67rw-2x62-mqqm - CC BY 4.0
Historial de vulnerabilidades: copyparty
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 14
- Primera → última
- 07.2023 08.2026
- Sin corrección
- 1
- Explotada en ataques
- 0
Distribución por gravedad
- Alta 3
- Media 8
- Baja 3
Divulgaciones por año
- 2023: 3
- 2024: 0
- 2025: 6
- 2026: 5
-
Copyparty ftp/sftp: Sharing a single file did not fully restrict source-folder access esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.