Copyparty ftp/sftp: Sharing a single file did not fully restrict source-folder access
There was a missing permission-check in the shares feature (the shr global-option).
This vulnerability only applies in the following scenario:
- The shares feature is used for the specific purpose of creating a share of just a single file inside a folder
- Either the FTP or SFTP server is enabled, and also made publically accessible
- If a share is password-protected, then SFTP was not vulnerable unless the
sftp-pwglobal-option was also enabled
- If a share is password-protected, then SFTP was not vulnerable unless the
Given these conditions, when a user is browsing a share through either FTP or SFTP (not http or https), they can gain read-access to the remaining files inside the shared folder by guessing/bruteforcing the filenames.
It was not possible to descend into subdirectories in this manner; only the sibling files were accessible.
This issue did not affect filekeys or dirkeys.
This vulnerability is CVE-2025-58753 which was previously fixed for HTTP and HTTPS, but not for FTP. The FTPS server did not yet exist at that time.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | copyparty | < 1.20.12 | 1.20.12 |
References
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-863- Platform
- Python (PyPI)
- Package
copyparty- Disclosed
- 11.03.2026
- Updated
- 11.10.2026 12:19
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-31 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-67rw-2x62-mqqm - CC BY 4.0
Vulnerability history: copyparty
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 14
- First → latest
- 07.2023 08.2026
- Without a fix
- 1
- Exploited in attacks
- 0
Severity breakdown
- High 3
- Medium 8
- Low 3
Disclosures per year
- 2023: 3
- 2024: 0
- 2025: 6
- 2026: 5
-
Copyparty ftp/sftp: Sharing a single file did not fully restrict source-folder access this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.