MEDIUM 4.3
PYSEC-2026-3660
Copyparty vulnerable to file/dirkey confusion
Quick fix
PYSEC-2026-3660 — copyparty: upgrade to the fixed version with the command below.
pip install --upgrade 'copyparty>=1.20.17'Details
A valid filekey could potentially be converted into a dirkey, granting read-access to the containing folder.
This issue only affected volumes which simultaneously enable both filekeys and dirkeys, with volflag `dk` or `dks` combined with `fk` or `fka`.
Both required features are default-disabled, and must be explicitly enabled in the volflags (the "flags" section of a volume).
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://github.com/9001/copyparty/security/advisories/GHSA-x5pq-m9p8-f4vx [WEB]
- https://github.com/9001/copyparty/commit/e40755331ba9449993ff482456e6bdd2c6deb950 [WEB]
- https://github.com/9001/copyparty [PACKAGE]
- https://github.com/9001/copyparty/releases/tag/v1.20.17 [WEB]
- https://pypi.org/project/copyparty [PACKAGE]
- https://github.com/advisories/GHSA-x5pq-m9p8-f4vx [ADVISORY]
- https://nvd.nist.gov/vuln/detail/CVE-2026-70657 [ADVISORY]