Log in
SECURITY: fix FTP upload outside volume
- read-only demo server at https://a.ocv.me/pub/demo/
- docker image β± similar software β± client testbed
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-27)
β οΈ ATTN: this release fixes a vulnerability in FTP and FTPS (not SFTP)
the FTP-server (default-disabled) would allow uploading to any folder that the copyparty process had permission to write to, but with certain limitations; see GHSA-phv8-wgjp-g4p9
recent important news
- v1.20.19 (2026-07-27) fixed an FTP-server vuln (upload outside defined volumes)
- v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled
- v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins
π§ͺ new features
- #1495 wopi integration -- edit office documents in the web-ui (thx @brandon-doornbos!) d57bb0c 10db423
- thumbnails: use embedded cover-image in videos when available 5952401
- thumbnails: folder-thumbs can be disabled with
th-covers: no(volflag or global) 856fada - #1555 macos: add --srch-nfkc to fix searching for filenames / paths in CJK languages a7c9909
- reduces search performance to around 30% when enabled
- hooks:
xbr/xardid not include old/new abspath as parameters; now they do c122e10
π©Ή bugfixes
- ftp: fix GHSA-phv8-wgjp-g4p9 b331bb1
- #1563 moving files between volumes could fail depending on OS and underlying filesystem c70dc7a
- fix drag-drop uploading in certain glitchy KDE environments (thx @tilse!) daf144a
- hooks:
xiucrashed if the fork-flag was set (thx @stackxp!) aa86235 - hooks:
xauwithout json-flag would be given the wark (file hash) instead of the abspath bae77b9 - shares: fix markdown-viewer (
?v) inside shares 6a9437b - ftp: fix logging from
xbuhooks 9912a95 - fix slow boot if a volume had lots of files in its toplevel folder cdb474c
- python2.7: fix multithreaded file-hashing 0f2040c
π§ other changes
- #1556 the libvips thumbnailer was demoted to last-fallback due to frequently using excessive amounts of ram ed0be42
- if -lo points to an existing file, it will now be appended to instead of overwritten depending on --rlo b6abc33
- #1530 nixos: the nix package now uses
ffmpeg-headlessinstead offfmpeg-full(thx @nyakase!) fface52 - slightly longer session cookie (was 20, now 24 chars) 537a99d
- Windows-specific:
πΎ what to download?
| download link | is it good? | description |
|---|---|---|
| copyparty-sfx.py | β the best π | runs anywhere! only needs python |
| copyparty-en.py | β also good | same but english-only, no i18n |
| a docker image | it's ok | good if you prefer docker π |
| copyparty.exe | β οΈ acceptable | for win8 or later; built-in thumbnailer |
| u2c.exe | β οΈ acceptable | CLI uploader as a win7+ exe (video) |
| copyparty.pyz | β οΈ acceptable | similar to the regular sfx, mostly worse |
| copyparty-en.pyz | β οΈ acceptable | english-only, no smb-server |
| copyparty32.exe | βοΈ dangerous | for win7 -- never expose to the internet! |
| cpp-winpe64.exe | βοΈ dangerous | runs on 64bit WinPE, otherwise useless |
| bootable usb | β(οΎβοΎ)β | a surprisingly useful joke (x86_64) |
- except for u2c.exe, all of the options above are mostly equivalent
- the zip and tar.gz files below are just source code
- python packages are available at PyPI
