CVE-2026-32108: 9001 copyparty incorrect authorization in FTP and SFTP shares

Executive brief

Copyparty is a file-sharing server. A security flaw in its file-sharing feature allows users who have been given access to a single file to potentially access other files in the same folder. This could lead to the unauthorized exposure of sensitive documents if an attacker can guess the names of other files in that directory.

Technical details

An incorrect authorization vulnerability (CWE-863) exists in copyparty's 'shares' feature when using the 'shr' global option. When a single file is shared via FTP or SFTP, the server fails to properly restrict access to sibling files within the same source folder. A remote attacker with access to the specific file share can read other files in the same directory by brute-forcing or guessing their filenames. This issue specifically affects the FTP and SFTP interfaces and does not allow navigation into subdirectories. The vulnerability is addressed in version 1.20.12.

Affected products

• 9001 copyparty < 1.20.12

Timeline

• 2026-03-11: disclosed
• 2026-03-12: advisory
• 1.20.12: patched

References

• https://api.github.com/users/thesanjok
• https://github.com/thesanjok
• https://api.github.com/users/thesanjok/gists%7B/gist_id%7D
• https://api.github.com/users/thesanjok/repos
• https://avatars.githubusercontent.com/u/55534535?v=4
• https://api.github.com/users/thesanjok/events%7B/privacy%7D