Copyparty Missing Permission Check in Shares Feature via FTP/SFTP

A vulnerability exists in Copyparty versions prior to 1.20.12, where a missing permission check in the shares feature allows unauthorized access to files. This issue arises when the shares feature is used to share a single file within a folder, and either the FTP or SFTP server is publicly accessible. Under these conditions, users can read other files in the shared folder by guessing or brute-forcing filenames, although subdirectory files are not accessible. This vulnerability is akin to CVE-2025-58753, which was addressed for HTTP and HTTPS but not for FTP.

Impact

Exploitation of this vulnerability could lead to unauthorized read access of files in the shared folder via FTP or SFTP.

Remediation

Users can upgrade to Copyparty version 1.20.12 or later to address this vulnerability.