CVE-2026-32108

Copyparty is a portable file server. Prior to 1.20.12, there was a missing permission-check in the shares feature (the shr global-option). This vulnerability only applies when the shares feature is used for the specific purpose of creating a share of just a single file inside a folder or either the FTP or SFTP server is enabled, and also made publicly accessible. Given these conditions, when a user is browsing a share through either FTP or SFTP (not http or https), they can gain read-access to the remaining files inside the shared folder by guessing/bruteforcing the filenames. It was not possible to descend into subdirectories in this manner; only the sibling files were accessible. This vulnerability is similar to CVE-2025-58753 which was previously fixed for HTTP and HTTPS, but not for FTP. The FTPS server did not yet exist at that time. This vulnerability is fixed in 1.20.12.

• CWE-863

• https://github.com/9001/copyparty/security/advisories/GHSA-67rw-2x62-mqqmVendor Advisory

Published

Mar 11, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32102OliveTin gives access to predefined shell commands from a we…6.5
• CVE-2026-32103StudioCMS is a server-side-rendered, Astro native, headless …7.2
• CVE-2026-32104StudioCMS is a server-side-rendered, Astro native, headless …5.4
• CVE-2026-32105xrdp is an open source RDP server. In versions through 0.10.…7.7
• CVE-2026-32106StudioCMS is a server-side-rendered, Astro native, headless …7.2
• CVE-2026-32107xrdp is an open source RDP server. In versions through 0.10.…8.8
• CVE-2026-32109Copyparty is a portable file server. Prior to 1.20.12, if an…4.4
• CVE-2026-3211Cross-Site Request Forgery (CSRF) vulnerability in Drupal Th…4.3
• CVE-2026-32110SiYuan is a personal knowledge management system. Prior to 3…8.3
• CVE-2026-32111ha-mcp is a Home Assistant MCP Server. Prior to 7.0.0, the h…5.3
• CVE-2026-32112ha-mcp is a Home Assistant MCP Server. Prior to 7.0.0, the h…4.7
• CVE-2026-32113Discourse is an open-source discussion platform. From versio…6.1