Starstruk Logo MarkStarstruk

v1.20.17

Wilfred/difftasticv1.20.17Jul 6, 2026by 9001

AI Summary

This release addresses a critical security vulnerability involving directory keys and file keys, introduces Content Security Policy (CSP) nonces for XSS defense, and adds sandboxing for FFmpeg. It also includes new features like CBZ reader improvements and additional volume flags.

Key Highlights

  • Fixes a critical dirkey vulnerability where a valid filekey could be converted into a dirkey
  • Enforces CSP nonces to defend against XSS attacks
  • Sandboxing support for FFmpeg/FFprobe to mitigate future vulnerabilities
  • New CBZ reader feature: 'go-to-page'
  • New volume flags: plainreadme, plainlogues, no_readme, and no_logues

Breaking Changes

  • CSP nonces may break some JavaScript-based plugins
  • FFmpeg sandboxing is disabled in Docker/Podman/Prisonparty

New Features

  • Enforce CSP nonces on javascript (additional xss defense)
  • Sandbox ffmpeg/ffprobe in bwrap to defend against future FFmpeg vulns
  • CBZ-reader: go-to-page
  • Volflags `plainreadme` and `plainlogues`
  • Volflags for `no_readme` and `no_logues`
  • U2C: new mode to calculate wark from data on stdin
  • `--ftp-banner`

Full Release Notes

<img src="https://github.com/9001/copyparty/raw/hovudstraum/docs/logo.svg" width="250" align="right"/>

* read-only demo server at https://a.ocv.me/pub/demo/
* [docker image](https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker) β•± [similar software](https://github.com/9001/copyparty/blob/hovudstraum/docs/versus.md) β•± [client testbed](https://cd.ocv.me/b/)

there is a [discord server](https://discord.gg/25J8CdTT6G) with an `@everyone` in case of future important updates, such as [vulnerabilities](https://github.com/9001/copyparty/security) (most recently 2026-07-06)

## ⚠️ ATTN: this release fixes a dirkey vulnerability

in volumes with **both** [dirkeys](https://github.com/9001/copyparty/#dirkeys) and [filekeys](https://github.com/9001/copyparty/#filekeys) enabled (default-disabled), a valid filekey could be converted into a dirkey, granting read-access to the containing folder

## recent important news

* [v1.20.17 (2026-07-06)](https://github.com/9001/copyparty/releases/tag/v1.20.17) fixed a vuln when a volume has both filekeys and dirkeys enabled
* [v1.20.17 (2026-07-06)](https://github.com/9001/copyparty/releases/tag/v1.20.17) introduced csp nonces, possibly breaking some javascript-based plugins

## πŸ§ͺ new features

* enforce csp nonces on javascript (additional xss defense) d3b95994
  * this could *possibly* break some aftermarket javascript-based plugins ([--js-browser](https://copyparty.eu/cli/#g-js-browser) / [--html-head](https://copyparty.eu/cli/#g-html-head))
  * now probably safe to disable the markdown/logue sandboxes ([--no-sb-md](https://copyparty.eu/cli/#g-no-sb-md) / `--no-sb-lg`) in most deployments, avoiding #230
* sandbox ffmpeg/ffprobe in bwrap to defend against future FFmpeg vulns efa43f89 85be3b8d
  * doesn't work in docker / podman, so `initcfg` in the images have [use-bwrap: n](https://copyparty.eu/cli/#g-use-bwrap) to disable it db68353e
  * doesn't work in [prisonparty](https://github.com/9001/copyparty/blob/hovudstraum/bin/prisonparty.sh) either... pain peko
* #1535 cbz-reader: go-to-page (thx @romfir!) 12d877b0
* volflags `plainreadme` and `plainlogues` to show readmes/logues as plaintext 9fa950bc
* volflags for `no_readme` and `no_logues` (previously global-only) 379c0aa6
* u2c: new mode to calculate wark from data on stdin 90639de9
* #1504 `--ftp-banner` 8242e693

## 🩹 bugfixes

* GHSA-x5pq-m9p8-f4vx (dir/filekey confusion) (thx @poolcritter!) e4075533
* fix resuming xbu-relocated partial uploads 5beecd66
* fix resuming partial uploads after server restart 22c3a3dd
* openbsd: fix signal masking for custom signals a00bc93f
* #1119 #1528 fix directory sort-order edgecases (thx @NecRaul!) d33d1132
* #1526 fix [--rotf-tz](https://copyparty.eu/cli/#g-rotf-tz); was effectively volflag-only (thx @NecRaul!) e017b1bc

## πŸ”§ other changes

* ffmpeg: remove lots of obscure codecs and formats for improved security 4c820301
* textfile-editor: some tweaks to the autobackup feature;
  * option [--md-nhist](https://copyparty.eu/cli/#g-md-nhist) to limit the number of old versions to keep 34c856e8
  * browsing old versions is now default-disabled; [--show-hist](https://copyparty.eu/cli/#g-show-hist) reenables it fa1499ae
* #1512 web-ui: if mkdir fails because folder already exists, then just cd into it 5dbff4af
* #1519 sftp: reduce excessive spam from portscanners 8c4e9313
* make database corruption more obvious on startup (usually due to broken server filesystem/hardware) be31a744
* docker:
  * #1532 add LABELs for version and creationtime 32d074ff
  * updated the [image compatibility matrix](https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker#editions) c3eb9ece
    * the `iv` image is no longer available for arm32 / armv6 6e75faa6

## 🌠 fun facts

* contains patches powered by [seventhrun - the ill shit](https://www.youtube.com/watch?v=_QW8mY663Ho&list=PLBO2h-GzDvIYRmupTCAasjzDjNxvjG639&index=12) + the rest of basschasers2 on [the Oslo-Bergen line](https://a.ocv.me/pub/g/2026/07/PXL_20260702_190436425b.jpg?cache), 1110 masl
* to those who celebrate, happy 6/7

----

# πŸ’Ύ what to download?
| download link | is it good? | description |
| -- | -- | -- |
| **[copyparty-sfx.py](https://github.com/9001/copyparty/releases/latest/download/copyparty-sfx.py)** | βœ… the best πŸ‘ | runs anywhere! only needs python |
| [copyparty-en.py](https://github.com/9001/copyparty/releases/latest/download/copyparty-en.py) | βœ… also good | same but english-only, no i18n |
| [a docker image](https://github.com/9001/copyparty/blob/hovudstraum/scripts/docker/README.md) | it's ok | good if you prefer docker πŸ‹ |
| [copyparty.exe](https://github.com/9001/copyparty/releases/latest/download/copyparty.exe) |  ⚠️ [acceptable](https://github.com/9001/copyparty#copypartyexe) | for [win8](https://user-images.githubusercontent.com/241032/221445946-1e328e56-8c5b-44a9-8b9f-dee84d942535.png) or later; built-in thumbnailer |
| [u2c.exe](https://github.com/9001/copyparty/releases/download/v1.20.17/u2c.exe) | ⚠️ acceptable | [CLI uploader](https://github.com/9001/copyparty/blob/hovudstraum/bin/u2c.py) as a win7+ exe ([video](https://a.ocv.me/pub/demo/pics-vids/u2cli.webm)) |
| [copyparty.pyz](https://github.com/9001/copyparty/releases/latest/download/copyparty.pyz) | ⚠️ acceptable | similar to the regular sfx, [mostly worse](https://github.com/9001/copyparty#zipapp) |
| [copyparty-en.pyz](https://github.com/9001/copyparty/releases/latest/download/copyparty-en.pyz) | ⚠️ acceptable | english-only, no smb-server |
| [copyparty32.exe](https://github.com/9001/copyparty/releases/latest/download/copyparty32.exe) | ⛔️ [dangerous](https://github.com/9001/copyparty#copypartyexe) | for [win7](https://user-images.githubusercontent.com/241032/221445944-ae85d1f4-d351-4837-b130-82cab57d6cca.png) -- never expose to the internet! |
| [cpp-winpe64.exe](https://github.com/9001/copyparty/releases/download/v1.16.5/copyparty-winpe64.exe) | ⛔️ dangerous | runs on [64bit WinPE](https://user-images.githubusercontent.com/241032/205454984-e6b550df-3c49-486d-9267-1614078dd0dd.png), otherwise useless |
| [bootable usb](https://a.ocv.me/pub/stuff/edcd001/enterprise-edition/) | ┐(οΎŸβˆ€οΎŸ)β”Œ | a surprisingly useful joke (x86_64) |

* except for [u2c.exe](https://github.com/9001/copyparty/releases/download/v1.20.17/u2c.exe), all of the options above are mostly equivalent
* the zip and tar.gz files below are just source code
* python packages are available at [PyPI](https://pypi.org/project/copyparty/#files)