Skip to content

copyparty

v1.20.18 Breaking

This release includes 1 breaking change for platform teams planning a safe upgrade.

Published 17d File Storage & Sync
βœ“ No known CVEs patched
Read the diff β†’ Tool health β†’ What is this tool? β†’

✓ No known CVEs patched in this version

Topics

copyparty file-server file-sharing file-upload-server ftp-server nas-frontend
+2 more
tftp-server webdav-server

Affected surfaces

auth breaking_upgrade

ReleasePort's take

Strong signal
editorial:auto 11d

The release patches a critical volume‑handling vulnerability and introduces CSP nonces that may break JavaScript plugins.

Why it matters: Patches a high‑severity (90) security flaw affecting volumes with both filekeys and dirkeys enabled; CSP nonce changes (70 severity) can disrupt existing JavaScript‑based plugins.

Summary

AI summary

Broad release touches πŸ”§ other changes, 🌠 fun facts, recent important news, and 2026-07-06.

Changes in this release

Security Critical

Fixes a vulnerability when a volume has both filekeys and dirkeys enabled.

Fixes a vulnerability when a volume has both filekeys and dirkeys enabled.

Source: llm_adapter@2026-07-16

Confidence: high

 β€”
Breaking High

Introduces CSP nonces, possibly breaking some JavaScript‑based plugins.

Introduces CSP nonces, possibly breaking some JavaScript‑based plugins.

Source: llm_adapter@2026-07-16

Confidence: high

 β€”
Feature Low

Adds shadowing: filesystem path `//NULL` fully unmapped from server's filesystem.

Adds shadowing: filesystem path `//NULL` fully unmapped from server's filesystem.

Source: llm_adapter@2026-07-16

Confidence: high

 β€”
Performance Low

Saves I/O by not refreshing thumbnail expiration times when `th-clean` is disabled.

Saves I/O by not refreshing thumbnail expiration times when `th-clean` is disabled.

Source: llm_adapter@2026-07-16

Confidence: high

 β€”
Deprecation Low

Default‑disables the bwrap ffmpeg sandbox; must be manually enabled with `use-bwrap: y`.

Default‑disables the bwrap ffmpeg sandbox; must be manually enabled with `use-bwrap: y`.

Source: llm_adapter@2026-07-16

Confidence: high

 β€”
Bugfix Medium

Fixes a false‑positive warning on startup.

Fixes a false‑positive warning on startup.

Source: llm_adapter@2026-07-16

Confidence: high

 β€”
Bugfix Medium

Always rotate `-lo` logfiles on startup unless `--rlo no` is specified.

Always rotate `-lo` logfiles on startup unless `--rlo no` is specified.

Source: llm_adapter@2026-07-16

Confidence: high

 β€”
Full changelog

there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-06)

recent important news

πŸ§ͺ new features

  • shadowing: filesystem-path //NULL will fully unmap a volume from the server's filesystem (no more /var/lib/empties/4 jank) 88846061

🩹 bugfixes

  • fix a false-positive warning on startup 12878e6c1cbf4417da42d46230dff686dd48760b

πŸ”§ other changes

  • #1552 #1551 default-disabled the bwrap ffmpeg sandbox; 85a8cc99
    • sandboxing can fail in too many creative ways (funky linux distros with funky filesystem layouts and policies) so autoconfiguring bwrap is not feasible
    • to enable it, set use-bwrap: y after adjusting th-bwrap to match your OS/env
      • see the default th-bwrap value in --help on your server for a best-effort guess
  • always rotate (never overwrite) -lo logfiles on startup unless --rlo no 29e145f5
  • thumbnails: save a tiny bit of I/O by not refreshing expiration-times if th-clean (expiration) is disabled anyways e15f2927

🌠 fun facts

  • no

πŸ’Ύ what to download?

| download link | is it good? | description |
| -- | -- | -- |
| copyparty-sfx.py | βœ… the best πŸ‘ | runs anywhere! only needs python |
| copyparty-en.py | βœ… also good | same but english-only, no i18n |
| a docker image | it's ok | good if you prefer docker πŸ‹ |
| copyparty.exe | ⚠️ acceptable | for win8 or later; built-in thumbnailer |
| u2c.exe | ⚠️ acceptable | CLI uploader as a win7+ exe (video) |
| copyparty.pyz | ⚠️ acceptable | similar to the regular sfx, mostly worse |
| copyparty-en.pyz | ⚠️ acceptable | english-only, no smb-server |
| copyparty32.exe | ⛔️ dangerous | for win7 -- never expose to the internet! |
| cpp-winpe64.exe | ⛔️ dangerous | runs on 64bit WinPE, otherwise useless |
| bootable usb | ┐(οΎŸβˆ€οΎŸ)β”Œ | a surprisingly useful joke (x86_64) |

  • except for u2c.exe, all of the options above are mostly equivalent
  • the zip and tar.gz files below are just source code
  • python packages are available at PyPI

Breaking Changes

  • Default-disabled the bwrap ffmpeg sandbox; to enable set `use-bwrap: y` after adjusting `th-bwrap`.
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track copyparty

Get notified when new releases ship.

Sign up free

About copyparty

Portable file server with accelerated resumable uploads, dedup, WebDAV, SFTP, FTP, TFTP, zeroconf, media indexer, thumbnails++ all in one file

All releases β†’

Related context

Beta — feedback welcome: [email protected]