Copyparty Missing Permission Check in Shares Feature Vulnerability

A vulnerability exists in Copyparty, a portable file server, in versions prior to 1.19.8. The issue arises from a missing permission check in the shares feature, specifically the 'shr' global option. When a share is created for a single file within a folder, it inadvertently allows access to other files in the same folder by guessing their names. This vulnerability does not extend to subdirectories, affecting only sibling files. Additionally, it does not impact filekeys or dirkeys.

Impact

Exploitation of this vulnerability could lead to unauthorized access to files within the same folder as the shared file, except for files in subdirectories.

Remediation

Users can upgrade to Copyparty version 1.19.8 or later to address this vulnerability.