要点
- CVE-2026-32108 は copyparty, copyparty (9001) に影響する深刻度「中」 (CVSS 6.5) の脆弱性です。
- 今後30日間に悪用される確率（EPSS）：0.29%（全脆弱性の 21.8% より高い）。
- 対処：1.20.12 以降に更新してください。
概要
There was a missing permission-check in the shares feature (the shr global-option).
This vulnerability only applies in the following scenario:
- The shares feature is used for the specific purpose of creating a share of just a single file inside a folder
- Either the FTP or SFTP server is enabled, and also made publically accessible
- If a share is password-protected, then SFTP was not vulnerable unless the
sftp-pw global-option was also enabled
Given these conditions, when a user is browsing a share through either FTP or SFTP (not http or https), they can gain read-access to the remaining files inside the shared folder by guessing/bruteforcing the filenames.
It was not possible to descend into subdirectories in this manner; only the sibling files were accessible.
This issue did not affect filekeys or dirkeys.
This vulnerability is CVE-2025-58753 which was previously fixed for HTTP and HTTPS, but not for FTP. The FTPS server did not yet exist at that time.
NVD の説明
Copyparty is a portable file server. Prior to 1.20.12, there was a missing permission-check in the shares feature (the shr global-option). This vulnerability only applies when the shares feature is used for the specific purpose of creating a share of just a single file inside a folder or either the FTP or SFTP server is enabled, and also made publicly accessible. Given these conditions, when a user is browsing a share through either FTP or SFTP (not http or https), they can gain read-access to the remaining files inside the shared folder by guessing/bruteforcing the filenames. It was not possible to descend into subdirectories in this manner; only the sibling files were accessible. This vulnerability is similar to CVE-2025-58753 which was previously fixed for HTTP and HTTPS, but not for FTP. The FTPS server did not yet exist at that time. This vulnerability is fixed in 1.20.12.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン