CVE-2026-70657: fallo de gravedad media en 9001 copyparty
Copyparty: file/dirkey confusion
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.3epss 0.3%
Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the containing folder. This vulnerability was only reachable if both types of keys (filekeys and dirkeys) were manually enabled in the volume flags simultaneously. This issue is fixed in version 1.20.17.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Productos afectados
9001 · copypartyCVEs relacionadas — 9001 copyparty
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-37474HIGHPath traversal in copypartyEPSS 44.9%CVE-2023-38501MEDIUMcopyparty vulnerable to reflected cross-site scripting via k304 parameterEPSS 9.2%CVE-2025-54589MEDIUMcopyparty Reflected XSS via Filter ParameterEPSS 2.4%CVE-2025-54796HIGHCopyparty is vulnerable to Regex Denial of Service (ReDoS) attacks through "Recent Uploads" pageEPSS 0.5%CVE-2025-54423MEDIUMcopyparty has a DOM-Based XSS vulnerability when displaying multimedia metadataEPSS 0.5%CVE-2025-27145LOWcopyparty renders unsanitized filenames as HTML when user uploads empty filesEPSS 0.5%