DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-70657: CVE-2026-70657: Logical Authorization Bypass in Copyparty Directory and File Key Handling

#security #cve #cybersecurity

CVE-2026-70657: Logical Authorization Bypass in Copyparty Directory and File Key Handling

Vulnerability ID: CVE-2026-70657
CVSS Score: 4.3
Published: 2026-08-18

A logical authorization bypass vulnerability in copyparty allows an attacker possessing a restricted file-level key to escalate privileges to directory-level access, exposing directory listings and adjacent files.

TL;DR

Copyparty is vulnerable to a privilege escalation vulnerability where a valid file key can be elevated to a directory key, allowing unauthorized directory listings and access to adjacent files when directory-key (dk) and file-key (fk) flags are enabled simultaneously.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-863
  • Attack Vector: Network
  • CVSS Score: 4.3 (Medium)
  • Exploit Status: PoC
  • KEV Status: Not Listed
  • Affected Function: tx_browser in copyparty/httpcli.py

Affected Systems

  • Copyparty File Server
  • copyparty: < 1.20.17 (Fixed in: 1.20.17)

Code Analysis

Commit: e407553

Fix directory-key logic elevation when file keys are actively used within browser request contexts

Mitigation Strategies

  • Upgrade Copyparty installations to v1.20.17 or later.
  • Isolate and separate configurations so directory-key (dk) and file-key (fk) flags are not combined on the same volume.
  • Deploy WAF rules to inspect and block directory index requests that include file-key parameters.

Remediation Steps:

  1. Identify all copyparty deployments in the inventory running versions prior to v1.20.17.
  2. Inspect configuration files (such as volume flags) for occurrences where both 'dk'/'dks' and 'fk'/'fka' are set.
  3. For temporary mitigation, remove either the file-key or directory-key flag from the shared volumes.
  4. Apply the official update using the system package manager or pull the v1.20.17 container image.
  5. Verify access separation by attempting to traverse to parent directories using an isolated file key.

References

Read the full report for CVE-2026-70657 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)