Is CVE-2026-32108 actively exploited?

No active exploitation of CVE-2026-32108 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-32108 be exploited remotely?

Yes. CVE-2026-32108 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-32108?

CVE-2026-32108 has a CVSS score of 6.5 (MEDIUM).

HOME VULNERABILITIESCVE-2026-32108

MEDIUM

CVE-2026-32108

CWE-863Published: March 11, 2026· Updated: Mar 13, 2026

6.5

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:8.2th

Official Description

Copyparty is a portable file server. Prior to 1.20.12, there was a missing permission-check in the shares feature (the shr global-option). This vulnerability only applies when the shares feature is used for the specific purpose of creating a share of just a single file inside a folder or either the FTP or SFTP server is enabled, and also made publicly accessible. Given these conditions, when a user is browsing a share through either FTP or SFTP (not http or https), they can gain read-access to the remaining files inside the shared folder by guessing/bruteforcing the filenames. It was not possible to descend into subdirectories in this manner; only the sibling files were accessible. This vulnerability is similar to CVE-2025-58753 which was previously fixed for HTTP and HTTPS, but not for FTP. The FTPS server did not yet exist at that time. This vulnerability is fixed in 1.20.12.

NVD Source

Technical Analysis

CVE-2026-32108 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 6.5.