N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-58753

CVE-2025-58753: copyparty: Sharing a single file does not fully restrict access to other files in source folder

There was a missing permission-check in the shares feature (the shr global-option).

When a share is created for just one file inside a folder, it was possible to access the other files inside that folder by guessing the filenames.

It was not possible to descend into subdirectories in this manner; only the sibling files were accessible.

This issue did not affect filekeys or dirkeys.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-58753

CVE-2025-58753:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
copyparty	pip	< 1.19.8	1.19.8

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because the VFS.canonical and VFS.dcanonical functions in copyparty/authsrv.py did not properly enforce access restrictions for shares created for single files. These functions are responsible for resolving user-provided paths to filesystem paths. The lack of validation allowed an attacker to guess and access other files in the same directory as the shared file.

The patch addresses this by introducing two new functions, _canonical_shr and _dcanonical_shr, which are specifically designed to handle path resolution for shares. These new functions check if the requested file is in the list of explicitly shared files (self.shr_files). If the file is not in the list, the functions return a value that prevents access.

The _reload function, which is responsible for setting up the virtual file system, is modified to use these new secure functions whenever a share is detected. This ensures that all path resolutions for shared files go through the new, more secure logic, effectively closing the vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.