v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled
v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins
🧪 new features
iPhone: new bug in iOS breaks uploading; add workaround 3ea671f
apple broke XHR/fetch in a recent iOS version by introducing some wtf race-conditions in response handling; under high network load, the browser simply forgets to tell js that there's a response, so we're basically flying blind
this workaround makes iOS uploads 50x faster than before but still not perfect (impossible given the situation); will be stuttery until apple fixes iOS
apple will probably fix it very soon given the severity of the bug, but at least one copyparty user is forever-stuck on iOS-18.x which will never be fixed by apple, so a workaround is justified
#1617 new plugin to thumbnail office documents with collabora (thx @kamaeff!) d4a1ce4
btrfs-specific: nocow .hist to improve sqlite performance dd9cf64
🩹 bugfixes
two low-severity vulns in different components, but surprisingly similar synopses:
GHSA-mc69-pxc8-4xf4 dirkeys (volflag dk) did not prevent descending into subdirs if an attacker could guess the name of the subdir 55969b8
GHSA-3fhv-rhjw-7hrg sftp did not fully enforce volflags xvol/xdev; an attacker could read a file inside the symlink destination if they could guess the name inside b80a210
not important enough to be listed in "recent important news", but will be detected by the (default-disabled) version-checker
#1628 fix http206 range-request for last-n-bytes bdf8b79
Restricts renderer file reads to paths the user has authorised, so opening and exporting a crafted diagram can no longer read arbitrary local files through the file IPC [GHSA-fjgc-8xgj-rvh4]
Corrects the AppImage compression method, so AppImageLauncher and other tools that expect gzip can read the image again [#2538]
Updates to draw.io core 31.4.4. All changes from 31.4.2 to 31.4.4 are added in this build.
Testing:
Verified against the packaged, signed macOS build. Linux and Windows packaging changes were verified from the produced release artifacts.
Base checks
Launch, open a file passed on the command line, add and edit shapes, undo and redo, save, insert and delete pages
Copy and paste through the system clipboard, which changed with Electron 44
Export to PNG, SVG and PDF from the app and from the command line
Diagram round trip in exported PNG, SVG and PDF, including reopening an exported PDF
Command line page selection with -p, and --size page against the default --size diagram
Quick Look preview on macOS renders the diagram
The macOS bundle is signed with a Developer ID certificate under the hardened runtime and is notarised, and the Quick Look app extension is sandboxed and separately signed
The x86_64 and arm64 AppImages are gzip compressed
readFile, fileStat, isFileWritable, watchFile, getFileDrafts, getBkpFile and checkFileExists all refuse paths the user has not authorised, including a symlink planted inside an authorised folder
A crafted diagram whose font source points at a local file exports with nothing embedded, checked by scanning the export for the file contents in both plain and base64 form
The font URL check rejects the evasions the URL parser would otherwise strip, being leading spaces, tabs and newlines in the scheme, uppercase schemes, and absolute, UNC and protocol relative paths, while still accepting http(s), data: and relative URLs
Checks around the read authorisation change
Libraries and templates declared in the configuration still load, and their shapes still appear in the sidebar
The configuration widens what may be read and not what may be written, checked by a write to a configured path being refused
Custom libraries added in earlier versions keep working after upgrading to this build
Drafts, backups, external change detection and the save conflict check still work
Authorisations survive a restart, so Recent Files keeps working
Saving a shape library opened from a file still writes without reopening the save dialog [#2518] [#2521]
also fixes wopi on servers where user does not have read/write-access to root volume
also restricts the token to just that one file; good if the wopi-client is some cloud thing that shouldn't be trusted
#1591 wopi: use persistent file-ID which is necessary for real-time collab (thx @kamaeff!) efcf96e
#1605 the lightbox can show svg images now 825f1c9
🩹 bugfixes
up2k: client could waste a little bandwidth while recovering from a network glitch 18791c5
if PRTY_CONFIG is set to a config-file that is also autodetected, then explain the misconfiguration instead of crashing like before 14e2d79
wopi: fix session-timeout hint to clients (thx @kamaeff!) 92c3f32
js: fix chance of duplicate prologue on very first page visit eeb399e
js: fix panic on image dragdrop out of the browser window dcc0abd
🔧 other changes
up2k: client now detects when server or reverseproxy is incorrectly configured with an impractically small request-body-size-limit, crashing the website with an explanation how to fix it f19ef03
also allows setting the chunksize all the way down to 1 megabyte when absolutely necessary (bad idea, slow)
shares: harden single-file shares some more 21c2c729ff6a71
just removing footguns (motivated by a bug-report that was a false-positive)
copyparty.exe: upgrade to python 3.14.7 from 3.13.14 8b6e897
larger and slightly faster (compensated for the size bloat by making the text-image-generator more shitty)
🌠 fun facts
the thumbex example is also a cool example how relevant the "pseudo" in PRNG can be; with random.randrange instead of os.urandom, first run followed by restarting copyparty and another run...heh
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-27)
⚠️ ATTN: this release fixes a vulnerability in FTP and FTPS (not SFTP)
the FTP-server (default-disabled) would allow uploading to any folder that the copyparty process had permission to write to, but with certain limitations; see GHSA-phv8-wgjp-g4p9
sandboxing can fail in too many creative ways (funky linux distros with funky filesystem layouts and policies) so autoconfiguring bwrap is not feasible
to enable it, set use-bwrap: y after adjusting th-bwrap to match your OS/env
see the default th-bwrap value in --help on your server for a best-effort guess
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-06)
⚠️ ATTN: this release fixes a dirkey vulnerability
in volumes with bothdirkeys and filekeys enabled (default-disabled), a valid filekey could be converted into a dirkey, granting read-access to the containing folder
recent important news
v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled
v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins
🧪 new features
enforce csp nonces on javascript (additional xss defense) d3b9599
this could possibly break some aftermarket javascript-based plugins (--js-browser / --html-head)
now probably safe to disable the markdown/logue sandboxes (--no-sb-md / --no-sb-lg) in most deployments, avoiding #230
sandbox ffmpeg/ffprobe in bwrap to defend against future FFmpeg vulns efa43f885be3b8
doesn't work in docker / podman, so initcfg in the images have use-bwrap: n to disable it db68353
Major version: new installs default to auto adaptive colours (matching web based draw.io); upgrades preserve simple. Change via Extras → Configuration.
Log in
