CVE-2026-32108 Copyparty ftp/sftp: Sharing a single file did not fully restrict source-folder access
Attackers can read sibling files in a shared folder via FTP/SFTP if shares are configured for single files, bypassing intended access restrictions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32108?
CVE-2026-32108 is a low-severity missing authorization vulnerability in 9001 copyparty, published on 11 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Copyparty is a portable file server. Prior to 1.20.12, there was a missing permission-check in the shares feature (the shr global-option). This vulnerability only applies when the shares feature is used for the specific purpose of creating a share of just a single file inside a folder or either the FTP or SFTP server is enabled, and also made publicly accessible. Given these conditions, when a user is browsing a share through either FTP or SFTP (not http or https), they can gain read-access to the remaining files inside the shared folder by guessing/bruteforcing the filenames. It was not possible to descend into subdirectories in this manner; only the sibling files were accessible. This vulnerability is similar to CVE-2025-58753 which was previously fixed for HTTP and HTTPS, but not for FTP. The FTPS server did not yet exist at that time. This vulnerability is fixed in 1.20.12.
Weakness: CWE-863
Which versions are affected by CVE-2026-32108?
3 open source packages ship an affected version, including copyparty. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
copyparty PyPI | All versions | 1.20.12 |
copyparty PyPI | All versions | 1.20.12 |
copyparty PyPI | All versions | 1.20.12 |
Products include 9001 Copyparty.
How do I fix CVE-2026-32108?
Upgrade copyparty to 1.20.12 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-32108 being exploited?
There is no known exploitation of CVE-2026-32108 in the wild and no public exploit code.
Other vulnerabilities in 9001 copyparty
- CVE-2023-41471 Cross-site scripting in n/a
- CVE-2025-54796 Copyparty is vulnerable to Regex Denial of Service (ReDoS) attacks through "Recent Uploads" page
- CVE-2023-37474 Path traversal in copyparty
- CVE-2025-54589 copyparty Reflected XSS via Filter Parameter
- CVE-2023-38501 copyparty vulnerable to reflected cross-site scripting via k304 parameter
Sources
Also known as GHSA-67rw-2x62-mqqm, PYSEC-2026-31.