MEDIUM 4.3
GHSA-x5pq-m9p8-f4vx
Copyparty vulnerable to file/dirkey confusion
Quick fix
GHSA-x5pq-m9p8-f4vx — copyparty: upgrade to the fixed version with the command below.
pip install --upgrade 'copyparty>=1.20.17'Details
A valid filekey could potentially be converted into a dirkey, granting read-access to the containing folder.
This issue only affected volumes which simultaneously enable both filekeys and dirkeys, with volflag `dk` or `dks` combined with `fk` or `fka`.
Both required features are default-disabled, and must be explicitly enabled in the volflags (the "flags" section of a volume).
Are you affected?
Enter the version of the package you're using.