The vulnerability originates from a missing permission check in Copyparty's shares feature when a single file is shared via the FTP or SFTP server. When the share is publicly accessible, an attacker who browses the share over FTP or SFTP can gain read access to any other files that reside in the same directory by guessing or brute‑forcing filenames. This grants confidentiality loss for sibling files but does not allow traversal into subdirectories or code execution.

The issue affects all versions of Copyparty older than 1.20.12, released by vendor 9001. Users running these versions with the FTP or SFTP server enabled and shares configured to expose a single file through the shr global option are exposed.

The CVSS score of 2.3 indicates low severity, and the EPSS probability is under 1%. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires an attacker to connect to the FTP or SFTP service, have the share publicly reachable, and guess or brute‑force filenames in the shared directory. Because the attack is limited to read operations on sibling files, the risk is low but still significant for sensitive data.