CVE-2026-70657— Copyparty: file/dirkey confusion
Possible ATT&CK Techniques 1AI
T1530 · Data from Cloud StorageGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-70657
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Copyparty: file/dirkey confusion
Source: CVE Program / CVE List V5
Vulnerability Description
Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the containing folder. This vulnerability was only reachable if both types of keys (filekeys and dirkeys) were manually enabled in the volume flags simultaneously. This issue is fixed in version 1.20.17.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-70657
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-70657
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-70657 (2)
Vendor Advisories for CVE-2026-70657 (1)
- 🔗 file/dirkey confusion · Advisory · 9001/copyparty · GitHubx_refsource_CONFIRM
IV. Related Vulnerabilities
Same product: copyparty
- CVE-2026-32109
Copyparty has unexpected JavaScript execution via crafted UR - CVE-2026-32108
Copyparty ftp/sftp: Sharing a single file did not fully rest - CVE-2026-30974
Copyparty volflag `nohtml` did not block javascript in svg f - CVE-2026-27948
Copyparty vulnerable to eflected cross-site scripting via se - CVE-2025-58753
copyparty: Sharing a single file does not fully restrict acc
Same vendor: 9001
- CVE-2026-32109
Copyparty has unexpected JavaScript execution via crafted UR - CVE-2026-32108
Copyparty ftp/sftp: Sharing a single file did not fully rest - CVE-2026-30974
Copyparty volflag `nohtml` did not block javascript in svg f - CVE-2026-27948
Copyparty vulnerable to eflected cross-site scripting via se - CVE-2025-58753
copyparty: Sharing a single file does not fully restrict acc
Same weakness: CWE-863
- CVE-2026-69555
Azure Arc Elevation of Privilege Vulnerability - CVE-2026-76019
Chrome < 151.0.7922.173 Workers越权漏洞 - CVE-2026-54136
Windmill: Resource-scoped API tokens can read script content - CVE-2026-7485
Frozen BI aggregations leak host and service names to unauth - CVE-2026-14949
Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnera
V. Comments for CVE-2026-70657
No comments yet