CVE-2026-70657

Name of the Vulnerable Software and Affected Versions Copyparty versions prior to 1.20.17

Description When the dk or dks directory-key flags are combined with the fk or fka file-key flags in a volume, a valid file key can be converted into a directory key. This allows unauthorized read access to the containing folder. This issue occurs only if both file-key and directory-key features are manually enabled in the volume flags, as they are disabled by default.

Recommendations Update to version 1.20.17.