Is CVE-2026-32108 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-32108 being exploited in the wild.

How severe is CVE-2026-32108?

Medium severity, with a CVSS score of 4, published 12 March 2026.

Which products and versions are affected?

copyparty (PyPI) < 1.20.12, ECOSYSTEM:introduced=0,fixed=1.20.12.

Is there a fix for CVE-2026-32108?

Yes. copyparty (PyPI): upgrade to 1.20.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-32108 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-32108?

Check whether you run copyparty (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-32108: 9001 copyparty incorrect authorization in FTP and SFTP shares

Q: Which products and versions are affected?

copyparty (PyPI) < 1.20.12, ECOSYSTEM:introduced=0,fixed=1.20.12.

Q: Is there a fix for CVE-2026-32108?

Yes. copyparty (PyPI): upgrade to 1.20.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-32108 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-32108?

Check whether you run copyparty (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-32108 · Severity: medium · CVSS 4 · Published 2026-03-12

Copyparty is a file-sharing server. A security flaw in its file-sharing feature allows users who have been given access to a single file to potentially access other files in the same folder. This could lead to the unauthorized exposure of sensitive documents if an attacker can guess the names of other files in that directory.

Technologies: copyparty (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-32108 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-32108 being exploited in the wild.
How severe is CVE-2026-32108?: Medium severity, with a CVSS score of 4, published 12 March 2026.
Which products and versions are affected?: copyparty (PyPI) < 1.20.12, ECOSYSTEM:introduced=0,fixed=1.20.12.
Is there a fix for CVE-2026-32108?: Yes. copyparty (PyPI): upgrade to 1.20.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32108 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-32108?: Check whether you run copyparty (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

copyparty (PyPI): upgrade to 1.20.12 or later
```
pip install "copyparty>=1.20.12"
```

Technical details

An incorrect authorization vulnerability (CWE-863) exists in copyparty's 'shares' feature when using the 'shr' global option. When a single file is shared via FTP or SFTP, the server fails to properly restrict access to sibling files within the same source folder. A remote attacker with access to the specific file share can read other files in the same directory by brute-forcing or guessing their filenames. This issue specifically affects the FTP and SFTP interfaces and does not allow navigation into subdirectories. The vulnerability is addressed in version 1.20.12.

Affected products

9001 copyparty < 1.20.12

Identifiers

CVE-2026-32108
GHSA-67rw-2x62-mqqm
PYSEC-2026-31

Timeline

2026-03-11: disclosed
2026-03-12: advisory
1.20.12: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.