CVE-2025-58753 copyparty: Sharing a single file does not fully restrict access to other files in source folder

What is CVE-2025-58753?

CVE-2025-58753 is a medium-severity missing authorization vulnerability in 9001 copyparty, published on 9 Sep 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Copyparty is a portable file server. In versions prior to 1.19.8, there was a missing permission-check in the shares feature (the `shr` global-option). When a share was created for just one file inside a folder, it was possible to access the other files inside that folder by guessing the filenames. It was not possible to descend into subdirectories in this manner; only the sibling files were accessible. This issue did not affect filekeys or dirkeys. Version 1.19.8 fixes the issue.

Weakness: CWE-862, CWE-552

Which versions are affected by CVE-2025-58753?

3 open source packages ship an affected version, including copyparty. It affects 1 product.

Products include 9001 Copyparty.

How do I fix CVE-2025-58753?

Upgrade copyparty to 1.19.8 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-58753 being exploited?

There is no known exploitation of CVE-2025-58753 in the wild and no public exploit code.

Other vulnerabilities in 9001 copyparty

• CVE-2023-41471 Cross-site scripting in n/a High 7.8
• CVE-2025-54796 Copyparty is vulnerable to Regex Denial of Service (ReDoS) attacks through "Recent Uploads" page High 7.5
• CVE-2023-37474 Path traversal in copyparty High 7.5
• CVE-2025-54589 copyparty Reflected XSS via Filter Parameter Medium 6.3
• CVE-2023-38501 copyparty vulnerable to reflected cross-site scripting via k304 parameter Medium 6.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-pxvw-4w88-6x95, PYSEC-2026-1279.