CVE-2026-32108

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32108", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-10T22:02:38.854Z", "datePublished": "2026-03-11T20:14:18.998Z", "dateUpdated": "2026-03-12T19:47:10.628Z"}, "containers": {"cna": {"title": "Copyparty ftp/sftp: Sharing a single file did not fully restrict source-folder access", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 2.3, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/9001/copyparty/security/advisories/GHSA-67rw-2x62-mqqm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/9001/copyparty/security/advisories/GHSA-67rw-2x62-mqqm"}], "affected": [{"vendor": "9001", "product": "copyparty", "versions": [{"version": "< 1.20.12", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-11T20:14:18.998Z"}, "descriptions": [{"lang": "en", "value": "Copyparty is a portable file server. Prior to 1.20.12, there was a missing permission-check in the shares feature (the shr global-option). This vulnerability only applies when the shares feature is used for the specific purpose of creating a share of just a single file inside a folder or either the FTP or SFTP server is enabled, and also made publicly accessible. Given these conditions, when a user is browsing a share through either FTP or SFTP (not http or https), they can gain read-access to the remaining files inside the shared folder by guessing/bruteforcing the filenames. It was not possible to descend into subdirectories in this manner; only the sibling files were accessible. This vulnerability is similar to CVE-2025-58753 which was previously fixed for HTTP and HTTPS, but not for FTP. The FTPS server did not yet exist at that time. This vulnerability is fixed in 1.20.12."}], "source": {"advisory": "GHSA-67rw-2x62-mqqm", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-12T19:47:04.137316Z", "id": "CVE-2026-32108", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T19:47:10.628Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32108", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-12T19:47:04.137316Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T19:47:07.765Z"}}], "cna": {"title": "Copyparty ftp/sftp: Sharing a single file did not fully restrict source-folder access", "source": {"advisory": "GHSA-67rw-2x62-mqqm", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.3, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "9001", "product": "copyparty", "versions": [{"status": "affected", "version": "< 1.20.12"}]}], "references": [{"url": "https://github.com/9001/copyparty/security/advisories/GHSA-67rw-2x62-mqqm", "name": "https://github.com/9001/copyparty/security/advisories/GHSA-67rw-2x62-mqqm", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Copyparty is a portable file server. Prior to 1.20.12, there was a missing permission-check in the shares feature (the shr global-option). This vulnerability only applies when the shares feature is used for the specific purpose of creating a share of just a single file inside a folder or either the FTP or SFTP server is enabled, and also made publicly accessible. Given these conditions, when a user is browsing a share through either FTP or SFTP (not http or https), they can gain read-access to the remaining files inside the shared folder by guessing/bruteforcing the filenames. It was not possible to descend into subdirectories in this manner; only the sibling files were accessible. This vulnerability is similar to CVE-2025-58753 which was previously fixed for HTTP and HTTPS, but not for FTP. The FTPS server did not yet exist at that time. This vulnerability is fixed in 1.20.12."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-11T20:14:18.998Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32108", "state": "PUBLISHED", "dateUpdated": "2026-03-12T19:47:10.628Z", "dateReserved": "2026-03-10T22:02:38.854Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-11T20:14:18.998Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "copyparty", "vendor": "9001", "versions": [{"status": "affected", "version": "< 1.20.12"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:9001:copyparty:*:*:*:*:*:*:*:*", "matchCriteriaId": "C5EE0A6C-C2FD-4A0D-A0AE-DFAFA3611249", "versionEndExcluding": "1.20.12", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Copyparty is a portable file server. Prior to 1.20.12, there was a missing permission-check in the shares feature (the shr global-option). This vulnerability only applies when the shares feature is used for the specific purpose of creating a share of just a single file inside a folder or either the FTP or SFTP server is enabled, and also made publicly accessible. Given these conditions, when a user is browsing a share through either FTP or SFTP (not http or https), they can gain read-access to the remaining files inside the shared folder by guessing/bruteforcing the filenames. It was not possible to descend into subdirectories in this manner; only the sibling files were accessible. This vulnerability is similar to CVE-2025-58753 which was previously fixed for HTTP and HTTPS, but not for FTP. The FTPS server did not yet exist at that time. This vulnerability is fixed in 1.20.12."}, {"lang": "es", "value": "Copyparty es un servidor de archivos port\u00e1til. Antes de la versi\u00f3n 1.20.12, exist\u00eda una comprobaci\u00f3n de permisos faltante en la funci\u00f3n de compartici\u00f3n (la opci\u00f3n global 'shr'). Esta vulnerabilidad solo se aplica cuando la funci\u00f3n de compartici\u00f3n se utiliza con el prop\u00f3sito espec\u00edfico de crear un recurso compartido de un solo archivo dentro de una carpeta o cuando el servidor FTP o SFTP est\u00e1 habilitado y tambi\u00e9n se hace accesible p\u00fablicamente. Dadas estas condiciones, cuando un usuario navega por un recurso compartido a trav\u00e9s de FTP o SFTP (no HTTP o HTTPS), puede obtener acceso de lectura a los archivos restantes dentro de la carpeta compartida adivinando/forzando los nombres de archivo. No era posible descender a subdirectorios de esta manera; solo los archivos hermanos eran accesibles. Esta vulnerabilidad es similar a CVE-2025-58753, que se hab\u00eda corregido previamente para HTTP y HTTPS, pero no para FTP. El servidor FTPS a\u00fan no exist\u00eda en ese momento. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 1.20.12."}], "id": "CVE-2026-32108", "lastModified": "2026-06-17T10:35:09.030", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32108", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-12T19:47:04.137316Z", "version": "2.0.3"}}]}, "published": "2026-03-11T21:16:16.760", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/9001/copyparty/security/advisories/GHSA-67rw-2x62-mqqm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.20.12)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "copyparty", "source": "cna", "vendor": "9001"}, "product": "copyparty", "vendor": "9001"}], "analysis": {"en": {"generated_at": "2026-03-17T16:25:07.741991+00:00", "value": {"mitigation_remediation": ["Upgrade Copyparty to version 1.20.12 or later where the permission check is fixed.", "If an upgrade is not immediately possible, disable the FTP or SFTP server, or remove public accessibility for shares that expose a single file.", "Restrict share configuration to avoid exposing single files in directories that contain sensitive data.", "Verify that the shares feature is not enabled for FTP or SFTP when not required."], "summary": {"action": "Apply Patch", "impact": "Confidentiality Disclosure"}, "threat_synthesis": {"affected_systems": "The issue affects all versions of Copyparty older than 1.20.12, released by vendor 9001. Users running these versions with the FTP or SFTP server enabled and shares configured to expose a single file through the shr global option are exposed.", "description_and_impact": "The vulnerability originates from a missing permission check in Copyparty's shares feature when a single file is shared via the FTP or SFTP server. When the share is publicly accessible, an attacker who browses the share over FTP or SFTP can gain read access to any other files that reside in the same directory by guessing or brute\u2011forcing filenames. This grants confidentiality loss for sibling files but does not allow traversal into subdirectories or code execution.", "risk_and_exploitability": "The CVSS score of 2.3 indicates low severity, and the EPSS probability is under 1%. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires an attacker to connect to the FTP or SFTP service, have the share publicly reachable, and guess or brute\u2011force filenames in the shared directory. Because the attack is limited to read operations on sibling files, the risk is low but still significant for sensitive data."}}}}, "created": "2026-03-12T09:56:13.313859+00:00", "updated": "2026-03-20T15:37:19.040167+00:00", "vendors": ["9001", "9001$PRODUCT$copyparty"]}