CVE-2026-32108: 
Python vulnerability analysis and mitigation

CVE-2026-32108 is a missing permission-check vulnerability in Copyparty, a portable file server, affecting the shares feature (shr global-option) when used over FTP or SFTP. It affects all Copyparty versions prior to 1.20.12 and was published on March 11, 2026. The vulnerability is closely related to CVE-2025-58753, which had previously patched the same issue for HTTP/HTTPS but not for FTP/SFTP. It carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 2.3 (Low) (GitHub Advisory, Copyparty Advisory).

The root cause is an incorrect authorization check (CWE-863) in Copyparty's shares feature when accessed via FTP or SFTP. When a single-file share is created within a folder and the FTP or SFTP server is publicly accessible, the server fails to enforce the intended access restriction to only the shared file. An authenticated (low-privilege) user browsing the share via FTP or SFTP can request sibling files within the same directory by guessing or brute-forcing filenames, bypassing the intended per-file access control. Notably, subdirectory traversal is not possible — only files at the same directory level are accessible — and password-protected shares were only vulnerable via SFTP if the sftp-pw global-option was also enabled (Copyparty Advisory, GitHub Advisory).

Successful exploitation allows an attacker with FTP or SFTP access to a publicly shared single-file share to gain unauthorized read access to other files residing in the same directory by brute-forcing filenames. The impact is limited to confidentiality — no integrity or availability impact exists — and is scoped to sibling files within the shared folder only, with no ability to traverse into subdirectories or access filekeys/dirkeys. This could expose sensitive files that the administrator intended to keep restricted, depending on what other files reside in the shared directory (Copyparty Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.016% (4th percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires specific preconditions: a single-file share must be configured, and FTP or SFTP must be publicly accessible, significantly limiting the attack surface.

1. Reconnaissance: Identify a publicly accessible Copyparty instance running a version prior to 1.20.12 with FTP or SFTP enabled, using network scanning tools (e.g., Shodan, Censys) or direct probing of FTP/SFTP ports (21, 22, or 990).
2. Access the share: Connect to the FTP or SFTP server using a low-privilege account or anonymous credentials (if permitted), and navigate to the directory exposed by the single-file share.
3. Enumerate sibling files: Attempt to retrieve files in the same directory by guessing or brute-forcing common filenames (e.g., using wordlists with tools like hydra, medusa, or custom scripts issuing FTP RETR or SFTP get commands for candidate filenames).
4. Exfiltrate accessible files: Successfully retrieve any sibling files whose names are guessed correctly, gaining unauthorized read access to content that was not intended to be shared (Copyparty Advisory).

• Network: Unusual volume of FTP RETR or SFTP get commands from a single client IP targeting multiple filenames in rapid succession; connections to FTP/SFTP ports from unexpected or external IP addresses.
• Logs: FTP/SFTP server access logs showing repeated failed and successful file retrieval attempts for files not part of the configured share, particularly with sequential or dictionary-pattern filenames; high frequency of 550 (file not found) FTP responses followed by occasional 226 (transfer complete) responses from the same session.
• File System: Access timestamps updated on files within a shared directory that were not part of the configured single-file share, indicating unauthorized reads.

Upgrade Copyparty to version 1.20.12 or later, which contains the fix for this vulnerability (Copyparty Advisory). As interim workarounds: disable public FTP and SFTP access if not strictly required; avoid using the single-file share feature in publicly accessible FTP/SFTP configurations; prefer HTTP/HTTPS for file sharing, which was patched against the equivalent issue (CVE-2025-58753) in an earlier release. If FTP/SFTP must remain enabled, restrict access to trusted users only and avoid placing sensitive files in the same directory as shared files.