CVE-2025-58753: copyparty File Sharing Access Control Vulnerability
Summary
CVE-2025-58753: copyparty: Sharing a single file does not fully restrict access to other files in source folder. Affects copyparty versions < 1.19.8. Fixed in 1.19.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Copyparty is an open-source file sharing server that allows users to share files over the internet. It provides features such as file sharing, directory browsing, and user management. However, a recent vulnerability has been identified that affects the access control mechanisms when sharing files, potentially exposing sensitive information.
Vulnerability Detail
The vulnerability arises from a missing permission check in the shares feature, specifically the 'shr' global-option. When a user creates a share for a single file within a folder, it inadvertently allows access to other files in the same folder through filename guessing. This means that while users cannot navigate into subdirectories, they can still access sibling files, which poses a risk of unauthorized data exposure. The issue does not affect filekeys or dirkeys, but it can lead to unintended information disclosure.
How To Fix
Latest published version: 1.20.26 as of 22 Oct 2026
pip install --upgrade "copyparty==1.20.26"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.19.8
This is the first release that contains the fix.
pip install --upgrade "copyparty==1.19.8"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid sharing individual files within a folder that contains sensitive sibling files until the package is updated. Additionally, consider using more restrictive sharing options or creating separate folders for sensitive files.
Conclusion
The CVE-2025-58753 vulnerability in the copyparty package highlights a significant issue with file sharing access controls. Users are strongly advised to update to the patched version to mitigate risks associated with unauthorized file access. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for copyparty →
FAQ
CVE-2025-58753 is a vulnerability in the copyparty package that allows unauthorized access to sibling files when sharing a single file due to a missing permission check.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to analyze your Pipfile.lock.
The primary risk is unauthorized access to sensitive files within the same folder, which could lead to data leaks or exposure of confidential information.
Yes, the vulnerability has been fixed in version 1.19.8 of the copyparty package. Users are encouraged to update to this version.
If immediate updating is not possible, consider using the workaround of avoiding sharing files in folders with sensitive sibling files until the update can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for copyparty.
