CVE-2026-70657 9001 CVE debrief

Who should care

Copyparty users and administrators who have manually enabled filekeys and dirkeys should assess their exposure and prioritize patching to version 1.20.17 or later. This vulnerability can lead to potential unauthorized folder access and impact data confidentiality, requiring attention and defensive actions from affected users.

Why it matters

CVE-2026-70657 is a medium-severity vulnerability in Copyparty that requires attention from users with specific configurations. It allows unauthorized folder access when directory-key and file-key flags are combined. Defenders should verify their deployments, prioritize patching, and assess potential impacts on data confidentiality.

• Potential unauthorized access to folders
• Need for verification of current access controls
• Priority patching for exposed deployments
• Possible impact on data confidentiality

Technical summary

The vulnerability in Copyparty arises from the combination of directory-key (dk or dks) and file-key (fk or fka) flags, which can convert a valid file key into a directory key, granting read access to the containing folder. This issue only occurs when both types of keys are manually enabled in the volume flags simultaneously. The vulnerability has a medium severity and requires attention from users with specific configurations. Defenders should prioritize patching to version 1.20.17 or later and assess potential impacts on data confidentiality.

Defensive priority

Medium-priority patching and verification recommended for Copyparty users with manually enabled filekeys and dirkeys.

Recommended defensive actions

• Patch Copyparty to version 1.20.17 or later
• Review and adjust volume flags for filekeys and dirkeys
• Verify access controls and folder permissions
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and its fix. However, additional information on potential exploitation or affected deployments is limited. Users should verify their Copyparty deployments, especially those with manually enabled filekeys and dirkeys, and assess their exposure. The CVE Program and NVD entries are official sources for this vulnerability information. Further verification and defensive actions are recommended based on the specific configurations and potential impacts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.