{"id":"CVE-2026-32108","aliases":["GHSA-67rw-2x62-mqqm","PYSEC-2026-31"],"url":"https://o3.security/vulnerability/CVE-2026-32108","summary":"Copyparty ftp/sftp: Sharing a single file did not fully restrict source-folder access","details":"There was a missing permission-check in the shares feature (the `shr` global-option).\n\nThis vulnerability only applies in the following scenario:\n* The [shares](https://github.com/9001/copyparty/#shares) feature is used for the specific purpose of creating a share of just a single file inside a folder\n* Either the FTP or SFTP server is enabled, and also made publically accessible\n  * If a share is password-protected, then SFTP was not vulnerable unless the `sftp-pw` global-option was also enabled\n\nGiven these conditions, when a user is browsing a share through either FTP or SFTP (not http or https), they can gain read-access to the remaining files inside the shared folder by guessing/bruteforcing the filenames.\n\nIt was not possible to descend into subdirectories in this manner; only the sibling files were accessible.\n\nThis issue did not affect filekeys or dirkeys.\n\nThis vulnerability is [CVE-2025-58753](https://nvd.nist.gov/vuln/detail/CVE-2025-58753) which was previously fixed for HTTP and HTTPS, but not for FTP. The FTPS server did not yet exist at that time.","published":"2026-03-11T20:14:18.998Z","modified":"2026-08-12T03:51:12.859326291Z","cvss":null,"epss":{"score":0.00274,"percentile":0.19275,"asOf":"2026-08-24"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"copyparty","fixedVersion":"1.20.12"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/9001/copyparty/security/advisories/GHSA-67rw-2x62-mqqm"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32108.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32108"},{"type":"PACKAGE","url":"https://github.com/9001/copyparty"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/copyparty/PYSEC-2026-31.yaml"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:12.859326291Z"}}