CVE-2026-32108: Copyparty FTP/SFTP Access Control Vulnerability
Summary
CVE-2026-32108: Copyparty ftp/sftp: Sharing a single file did not fully restrict source-folder access. Affects copyparty versions < 1.20.12. Fixed in 1.20.12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Copyparty is an open-source file-sharing application that allows users to share files over FTP and SFTP protocols. It is designed to facilitate easy file transfers while providing various features such as sharing folders and files. However, a recent vulnerability has been identified that affects the security of shared files when using FTP or SFTP, particularly when sharing a single file from a folder.
Vulnerability Detail
The vulnerability arises from a missing permission check in the shares feature of Copyparty, specifically when the shr global-option is used to create a share of a single file. If the FTP or SFTP server is enabled and publicly accessible, users can potentially gain unauthorized read access to sibling files within the shared folder by guessing or brute-forcing filenames. This issue does not affect filekeys or dirkeys and was previously addressed for HTTP and HTTPS but remains unpatched for FTP.
How To Fix
Latest published version: 1.20.26 as of 22 Oct 2026
pip install --upgrade "copyparty==1.20.26"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.20.12
This is the first release that contains the fix.
pip install --upgrade "copyparty==1.20.12"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the FTP or SFTP server until the package is updated to the patched version. Additionally, avoid using the shares feature to share single files until the vulnerability is resolved.
Conclusion
In summary, CVE-2026-32108 presents a significant security risk for users of the Copyparty application when sharing files via FTP or SFTP. It is crucial to update to the patched version or implement workarounds to mitigate potential unauthorized access to sensitive files.
See every vulnerability recorded for copyparty →
FAQ
CVE-2026-32108 is a vulnerability in the Copyparty application that allows unauthorized access to sibling files in a shared folder via FTP or SFTP.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update to the patched version, consider disabling the FTP or SFTP server temporarily and avoid using the shares feature for single files.
The risks include unauthorized access to sensitive files within the shared folder, which could lead to data breaches or exposure of confidential information.
The CVSS score of this vulnerability is 2.3, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for copyparty.
