Copyparty is a portable file server. Prior to 1.20.17, volumes with the dk or dks directory‑key flag combined with the fk or fka file‑key flag can convert a valid file key into a directory key, granting read access to the containing folder. This vulnerability is only reachable if both types of keys (filekeys and dirkeys) are manually enabled in the volume flags simultaneously. The flaw leads to information disclosure and is classified as CWE‑863: Interface Logic Error.

Any deployment of the Copyparty portable file server running a version earlier than 1.20.17 that has enabled the dk/dks directory‑key or dks flags in conjunction with the fk/fka file‑key flags. The flaw is present only if both sets of flags are explicitly activated; by default, they are disabled.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, implying no known widespread exploitation yet. However, because the flaw can be triggered by explicitly enabling specific flags, organizations that have customized these settings may be able to read directory contents without authorization, making the risk more tangible for those environments.