PT-2025-36951 · Copyparty · Copyparty

9001 · CVE-2025-58753 · Published 2025-09-09 · Updated 2026-07-07

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Copyparty versions prior to 1.19.8

Description: Copyparty is a portable file server. A missing permission-check in the shares feature (shr global-option) allowed access to sibling files within a shared folder by guessing filenames when a share was created for only one file inside that folder. Access was limited to sibling files and did not extend to subdirectories. This issue did not affect filekeys or dirkeys.

Recommendations: Update to version 1.19.8 or later.

Exploit

Fix

Files Accessible to External Parties

Missing Authorization

Weakness Enumeration

CWE-552

CWE-862

Related Identifiers

CVE-2025-58753

GHSA-PXVW-4W88-6X95

PYSEC-2026-1279

Affected Products

Copyparty

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58753.json · Exploit
• https://github.com/9001/copyparty/security/advisories/GHSA-pxvw-4w88-6x95 · Vendor Advisory
• https://github.com/9001/copyparty/commit/e0a92ba72d46074209a9c304eb2a01ca0429e60c · Patch
• https://osv.dev/vulnerability/GHSA-pxvw-4w88-6x95 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-1279 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58753 · Security Note
• https://osv.dev/vulnerability/CVE-2025-58753 · Vendor Advisory
• https://github.com/9001/copyparty/releases/tag/v1.19.8 · Note
• https://github.com/9001/copyparty · Note
• https://twitter.com/dailycve/status/2032168694709620954 · Twitter Post
• https://twitter.com/CVEnew/status/1965509602197602547 · Twitter Post
• https://t.me/CVEtracker/47167 · Telegram Post
• https://pypi.org/project/copyparty · Note
• https://t.me/CVEtracker/32112 · Telegram Post
• https://github.com/advisories/GHSA-pxvw-4w88-6x95 · Note