CVE-2026-70657: Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can…

PriorityP424medium4.3CVSS 3.1

AVNACLPRLUINSUCLINAN

EPSS

0.33%

25.0th percentile

Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the containing folder. This vulnerability was only reachable if both types of keys (filekeys and dirkeys) were manually enabled in the volume flags simultaneously. This issue is fixed in version 1.20.17.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
9001	copyparty	< 1.20.17	1.20.17
9001	copyparty	>= 0 < 1.20.17	1.20.17

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.