v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled
v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins
🧪 new features
iPhone: new bug in iOS breaks uploading; add workaround 3ea671f
apple broke XHR/fetch in a recent iOS version by introducing some wtf race-conditions in response handling; under high network load, the browser simply forgets to tell js that there's a response, so we're basically flying blind
this workaround makes iOS uploads 50x faster than before but still not perfect (impossible given the situation); will be stuttery until apple fixes iOS
apple will probably fix it very soon given the severity of the bug, but at least one copyparty user is forever-stuck on iOS-18.x which will never be fixed by apple, so a workaround is justified
#1617 new plugin to thumbnail office documents with collabora (thx @kamaeff!) d4a1ce4
btrfs-specific: nocow .hist to improve sqlite performance dd9cf64
🩹 bugfixes
two low-severity vulns in different components, but surprisingly similar synopses:
GHSA-mc69-pxc8-4xf4 dirkeys (volflag dk) did not prevent descending into subdirs if an attacker could guess the name of the subdir 55969b8
GHSA-3fhv-rhjw-7hrg sftp did not fully enforce volflags xvol/xdev; an attacker could read a file inside the symlink destination if they could guess the name inside b80a210
not important enough to be listed in "recent important news", but will be detected by the (default-disabled) version-checker
#1628 fix http206 range-request for last-n-bytes bdf8b79
also fixes wopi on servers where user does not have read/write-access to root volume
also restricts the token to just that one file; good if the wopi-client is some cloud thing that shouldn't be trusted
#1591 wopi: use persistent file-ID which is necessary for real-time collab (thx @kamaeff!) efcf96e
#1605 the lightbox can show svg images now 825f1c9
🩹 bugfixes
up2k: client could waste a little bandwidth while recovering from a network glitch 18791c5
if PRTY_CONFIG is set to a config-file that is also autodetected, then explain the misconfiguration instead of crashing like before 14e2d79
wopi: fix session-timeout hint to clients (thx @kamaeff!) 92c3f32
js: fix chance of duplicate prologue on very first page visit eeb399e
js: fix panic on image dragdrop out of the browser window dcc0abd
🔧 other changes
up2k: client now detects when server or reverseproxy is incorrectly configured with an impractically small request-body-size-limit, crashing the website with an explanation how to fix it f19ef03
also allows setting the chunksize all the way down to 1 megabyte when absolutely necessary (bad idea, slow)
shares: harden single-file shares some more 21c2c729ff6a71
just removing footguns (motivated by a bug-report that was a false-positive)
copyparty.exe: upgrade to python 3.14.7 from 3.13.14 8b6e897
larger and slightly faster (compensated for the size bloat by making the text-image-generator more shitty)
🌠 fun facts
the thumbex example is also a cool example how relevant the "pseudo" in PRNG can be; with random.randrange instead of os.urandom, first run followed by restarting copyparty and another run...heh
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-27)
⚠️ ATTN: this release fixes a vulnerability in FTP and FTPS (not SFTP)
the FTP-server (default-disabled) would allow uploading to any folder that the copyparty process had permission to write to, but with certain limitations; see GHSA-phv8-wgjp-g4p9
sandboxing can fail in too many creative ways (funky linux distros with funky filesystem layouts and policies) so autoconfiguring bwrap is not feasible
to enable it, set use-bwrap: y after adjusting th-bwrap to match your OS/env
see the default th-bwrap value in --help on your server for a best-effort guess
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-06)
⚠️ ATTN: this release fixes a dirkey vulnerability
in volumes with bothdirkeys and filekeys enabled (default-disabled), a valid filekey could be converted into a dirkey, granting read-access to the containing folder
recent important news
v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled
v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins
🧪 new features
enforce csp nonces on javascript (additional xss defense) d3b9599
this could possibly break some aftermarket javascript-based plugins (--js-browser / --html-head)
now probably safe to disable the markdown/logue sandboxes (--no-sb-md / --no-sb-lg) in most deployments, avoiding #230
sandbox ffmpeg/ffprobe in bwrap to defend against future FFmpeg vulns efa43f885be3b8
doesn't work in docker / podman, so initcfg in the images have use-bwrap: n to disable it db68353
config-files can now use OS environment-variables anywhere in the [global] config section cbd82b6e52bbed
by default, only the syntax ${VAR} is supported, not $VAR or %VAR%
previously, a small handful of global-options already supported this (c lo hist dbpath ssl_log), but they also supported the $VAR syntax, which is no longer the case
if the old $VAR syntax is detected, copyparty will crash on startup, suggesting the following remedies (choose one!) in the log:
update the config-value to the new ${VAR} syntax (recommended)
allow the old syntax with global-option --env-expand 1 (risky)
ignore the old syntax and only expand the new syntax with global-option --env-expand 2
disable all environment-variable expansions with PRTY_NO_ENVEXPAND=1
🩹 bugfixes
#1437 webdav clients can now PROPFIND a file with depth: infinite which at least webdav4 does e00f2b4
#1392 navigating into a subfolder using a dksdirkey (default-disabled) could fail 228c3df
cosmetic filter to exclude specific files from directory listings by adding their filenames to a textfile named .hidden similar to many linux desktop file managers
the files are still easily available from various APIs; this is not a security feature, just a way to keep things neat and tidy
shares: now possible to grant the . permission to see dotfiles 66f9c95
🩹 bugfixes
#1372#1333 no thumbnails if the server OS was too old to have JXL support and the webbrowser was asking for JXL 1afe48b
#1363 new-version alert would only appear if the visitor had the Admin permission in the webroot specifically; now A in any volume is sufficient 6eb4f0a
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-03-08)
⚠️ ATTN: this release fixes an ftp/sftp issue with shares
GHSA-67rw-2x62-mqqm: when a share is created for just one or more files inside a folder, it was possible to use FTP or SFTP to access the other files inside that folder by guessing the filenames
so ignore this issue if you did not enable ftp or sftp in the server config
it was not possible to descend into subdirectories in this manner; only the sibling files were accessible
NOTE: this does NOT affect filekeys; this is specifically regarding the shr global-option
password-protected shares were not affected through SFTP, only FTP
this release also fixes GHSA-rcp6-88mm-9vgf but that one is nothing to worry about
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-03-08)
⚠️ ATTN: this release fixes a vulnerability
GHSA-m6hv-x64c-27mm the nohtml volflag did not prevent javascript inside SVG images from executing -- a malicious user with write-access could upload an SVG file which would execute as javascript when someone opens it 1c9f894
#1324 better rclone advice on the connect-page 8941701
static website resources, previously served from /.cpr/ have moved to /.cpr/w/ for easier configuration of allowlists in reverseproxies and authentication middlewares 753ff54
🌠 fun facts
according to the SVG spec, images being able to execute javascript is a feature and intentional behavior... what a concept!
this primarily means photos/videos taken with iphones (and maybe some samsung phones)
on the bright side, this has made the docker-images much smaller; ac is now half the size it used to be, and iv / dj are each 97 MiB smaller
🌠 fun facts
if you wanna see your car doing its best impression of a frictionless spherical cow, I can warmly (heh) recommend the icy snowcoated countryroads of viken this weekend
#1276 option rw-edit is the list of file-extensions that can be edited as textfiles with only permissions read+write (default is md like before); all other files still require read+write+delete 312f48ed692838
#1288 option to customize the links copied when selecting files and pressing ctrl-c (thx @icxes!) e5d0a05
docker: add env-var DI_PREPARTY to run an arbitrary script during startup, for customizations and such bf01ca4
🩹 bugfixes
#1279 the textfile-viewer would refuse to load huge documents when hotlinked f02e9cf
#1280 the custom rightclick-menu was enabled in the textfile viewer fc8a4b8
#1262 logtail now works on windows; would previously take an exclusive-lock on the monitored file, as windows does by default a368fc6
🔧 other changes
volumes are hidden from the treeview if the name starts with a dot 76041fd
#1277descript.ion files no longer require the e2d and e2t options to be enabled 4cb4e82
chunked PUT-uploads are now terminated if they exceed a configured size limit dfadb5a
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)
🧪 new features
#1264 now possible to grant the get permission when creating a share 95b827f
the button was already there, but until now it did nothing
🩹 bugfixes
a safeguard (24141b4) added in v1.20.5 was too strict and would block requests from certain reverseproxies, specifically anything that adds X-Forwarded-HTTP-Version72224d2
replaced the connection:close band-aid added in v1.20.4 with a proper fix that doesn't make things slower behind reverseproxies
I've tried everything I can think of (with nginx as reverseproxy) and can't notice any difference in behavior, but please let me know if this breaks anything for you 🙏
#1231 fix http desync if the urlform global-option was changed to get
this initial fix only applies when reverse-proxied, in which case copyparty will now always connection:close (don't reuse tcp/uds connections), as giving each client a fresh socket helps avoid all such issues e1eff21b4fddbc
the expected performance impact from this change is near-zero for real use, even if benchmarks show a 40% reduction in requests/sec in the absolute-worst-case (burst of cheap requests)
a future version will also fix this issue for non-proxied clients
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2025-09-07)
🧪 new features
send-message-to-serverlog now also available as url-parameter ?smsg=foo6dcb1ef
option smsg configures which HTTP-methods to allow; can be set to GET,POST but default is only POST because GET is dangerous (CSRF)
🩹 bugfixes
#1227dillo was not able to login because dillo is more standards-compliant than every other browser (nice) b4df8fa
a web-scraper which got banned for making malicious requests could remain banned for one request longer than intended (wait why did I fix this) ba67b27
#1203 configured chmod/chown rules were not applied when a file was being deduped bef0772
the unlistc* volflags could not be specified for single-file volumes 2664891
the defensive renaming of uploaded readmes/logues would assume the default filenames, not considering the recently added option to customize these names c17c3be
#1191 the ipu option can once again be used to reject connections from certain IP-ranges caf831f
this was a regression in v1.19.21 causing the server to crash on startup if such a config was attempted
some empty folders could be created during startup in certain server-configs with nested volumes 4e67b46
api: trying to ?ls nested virtual folders could return an error 6675039
ui/ux:
#1179 improve errormessage if audio transcoding fails 7357d46
ensure a trailing slash when viewing a folder with the h permission; good for relative links in html-files
truncate huge errormessages from ffmpeg so the log doesn't get flooded 3aebfab
ui/ux:
the dl button (to download selected files individually) now skips folders, since that never worked bc24604
#1200 add html classes to make custom styling easier c46cd7f
rephrase errormessages from see serverlog to see fileserver log
docs:
mention in the readme that uploading files from a deeply nested folder using a webbrowser on Windows can fail because browsers don't handle the max-pathlen limitation of Windows optimally (not a copyparty-specific issue, but still hits us)
v1.14.3 (2024-08-30) fixed a bug that was introduced in v1.13.8 (2024-08-13); this bug could lead to data loss -- see the v1.14.3 release-notes for details
🧪 new features
hooks now behave more usefully/predictably; 889bd32
hooks returning 0 will run the next hook (if any), and let the initiating action proceed if no other hooks object
hooks returning 100 will stop processing successive hooks, but return success, letting the initiating action proceed
hooks returning anything else will stop processing successive hooks (like the documentation always said) and also fail the initiating action (if hook is checked)
zmq hooks can now respond with json, doing relocations and all that stuff
v1.14.3 (2024-08-30) fixed a bug that was introduced in v1.13.8 (2024-08-13); this bug could lead to data loss -- see the v1.14.3 release-notes for details
🧪 new features
#961 the /?shares listing now shows the list of filenames for each share 2cc53ea
🩹 bugfixes
#967 per-volume md/lg sandbox rules are now applied during navigation db60951
if a volume has no-sb-lg or no-sb-md set then it'll apply when navigating into that volume, and vice-versa
v1.14.3 (2024-08-30) fixed a bug that was introduced in v1.13.8 (2024-08-13); this bug could lead to data loss -- see the v1.14.3 release-notes for details
v1.14.3 (2024-08-30) fixed a bug that was introduced in v1.13.8 (2024-08-13); this bug could lead to data loss -- see the v1.14.3 release-notes for details
🧪 new features
#949 when all uploads have finished, the client (both the browser and u2c) sends a message to the server saying it's done db87ea5
#941copyparty-en.pyz, yet another copyparty variant, with enterprise-friendly tweaks:
does not include the smb-server, so antivirus doesn't think it's malware 7f5810f
english-only, because antivirus apparently hates certain translations too 7f5810f
renamed the webdav-config .bat to .txt because clearly only one of those are "dangerous" b624a38
show volumes with permssion h in the navpane fff7291
#937 global-option --notooltips to default-disable tooltips a325353
🩹 bugfixes
#948 fix the u2c --dr option when the server is running on windows d3dd345
fix crash on startup when using volflags unlistc* and the parent folder is not a volume cdd5e78
og / opengraph / discord-embed fixes:
using the h permission could result in unexpected 404 c9e45c1
a single-file volume could make filenames in its parent volume unintentionally visible 36ab77e
this would only happen when combined with --og
fix some harmless warnings from single-file volumes b1efc00
Log in
