PT-2025-36951 · Copyparty · Copyparty

9001 · Published 2025-09-09 · Updated 2026-03-12 · CVE-2025-58753

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Copyparty versions prior to 1.19.8

Description: Copyparty is a portable file server. A missing permission-check in the shares feature (shr global-option) allowed access to sibling files within a shared folder by guessing filenames when a share was created for only one file inside that folder. Access was limited to sibling files and did not extend to subdirectories. This issue did not affect filekeys or dirkeys.

Recommendations: Update to version 1.19.8 or later.

Exploit

Fix

Missing Authorization

Files Accessible to External Parties

Weakness Enumeration

CWE-862

CWE-552

Related Identifiers

CVE-2025-58753

GHSA-PXVW-4W88-6X95

Affected Products

Copyparty

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58753.json · Exploit
• https://github.com/9001/copyparty/security/advisories/GHSA-pxvw-4w88-6x95 · Vendor Advisory
• https://github.com/9001/copyparty/commit/e0a92ba72d46074209a9c304eb2a01ca0429e60c · Patch
• https://osv.dev/vulnerability/CVE-2025-58753 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58753 · Security Note
• https://osv.dev/vulnerability/GHSA-pxvw-4w88-6x95 · Vendor Advisory
• https://github.com/9001/copyparty · Note
• https://github.com/9001/copyparty/releases/tag/v1.19.8 · Note
• https://twitter.com/CVEnew/status/1965509602197602547 · Twitter Post
• https://t.me/CVEtracker/32112 · Telegram Post
• https://twitter.com/dailycve/status/2032168694709620954 · Twitter Post
• https://t.me/CVEtracker/47167 · Telegram Post