Nixpkgs security tracker

Try the new UI
Login with GitHub

Suggestions search

All statuses
Filter by:
With package: copyparty-most

Found 3 matching suggestions

View:
Compact
Detailed
Untriaged
Permalink CVE-2026-70657
4.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
created 1 month ago Activity log
  • Created suggestion 1 month ago
Copyparty: file/dirkey confusion

Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the containing folder even though both features are disabled by default and must be explicitly enabled in the volume flags. This issue is fixed in version 1.20.17.

Affected products

copyparty
  • ==< 1.20.17

Matching in nixpkgs

pkgs.copyparty

turn almost any device into a file server over http(s), webdav, ftp(s), and tftp

  • nixos-unstable -
  • nixos-26.05 -

pkgs.copyparty-min

turn almost any device into a file server over http(s), webdav, ftp(s), and tftp - minimal variant

  • nixos-unstable -
  • nixos-26.05 -

pkgs.copyparty-most

turn almost any device into a file server over http(s), webdav, ftp(s), and tftp - most variant

  • nixos-unstable -
  • nixos-26.05 -

pkgs.copyparty-full-buggy

turn almost any device into a file server over http(s), webdav, ftp(s), and tftp - full variant

  • nixos-unstable -
  • nixos-26.05 -

Package maintainers

Dismissed
Permalink CVE-2026-30974
4.6 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 6 months, 1 week ago by @mweinelt Activity log
  • Created suggestion 6 months, 1 week ago
  • @mweinelt dismissed 6 months, 1 week ago
Copyparty volflag `nohtml` did not block javascript in svg files

Copyparty is a portable file server. Prior to v1.20.11., the nohtml config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG images. A user with write-permission could upload an SVG containing embedded JavaScript, which would execute in the context of whichever user opens it. This has been fixed in v1.20.11.

Affected products

copyparty
  • ==< 1.20.11

Matching in nixpkgs

pkgs.copyparty

turn almost any device into a file server over http(s), webdav, ftp(s), and tftp

  • nixos-unstable -

pkgs.copyparty-min

turn almost any device into a file server over http(s), webdav, ftp(s), and tftp - minimal variant

  • nixos-unstable -

pkgs.copyparty-most

turn almost any device into a file server over http(s), webdav, ftp(s), and tftp - most variant

  • nixos-unstable -

pkgs.copyparty-full-buggy

turn almost any device into a file server over http(s), webdav, ftp(s), and tftp - full variant

  • nixos-unstable -

Package maintainers

https://github.com/NixOS/nixpkgs/pull/498063
https://github.com/NixOS/nixpkgs/pull/498654
Published
Permalink CVE-2026-27948
5.4 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 6 months, 3 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 3 weeks ago
  • @LeSuisse accepted 6 months, 3 weeks ago
  • @LeSuisse published on GitHub 6 months, 3 weeks ago
Copyparty vulnerable to eflected cross-site scripting via setck parameter

Copyparty is a portable file server. In versions prior to 1.20.9, an XSS allows for reflected cross-site scripting via URL-parameter `?setck=...`. Version 1.20.9 fixes the issue.

Affected products

copyparty
  • ==< 1.20.9

Matching in nixpkgs

pkgs.copyparty

turn almost any device into a file server over http(s), webdav, ftp(s), and tftp

pkgs.copyparty-min

turn almost any device into a file server over http(s), webdav, ftp(s), and tftp - minimal variant

pkgs.copyparty-most

turn almost any device into a file server over http(s), webdav, ftp(s), and tftp - most variant

pkgs.copyparty-full-buggy

turn almost any device into a file server over http(s), webdav, ftp(s), and tftp - full variant

Package maintainers

Upstream advisory: https://github.com/9001/copyparty/security/advisories/GHSA-62cr-6wp5-q43h
Upstream patch: https://github.com/9001/copyparty/commit/31b2801fd041f803f4a3d5c12c7d7cb5419048bc