Starstruk Logo MarkStarstruk

v1.20.17

Xiaojiu-z/EasyControlv1.20.17Jul 6, 2026by 9001

AI Summary

A critical security release that fixes a vulnerability where filekeys could be converted into dirkeys, granting unauthorized read access. It also introduces Content Security Policy (CSP) nonces for XSS defense and adds new features like CBZ reader navigation.

Key Highlights

  • Fixed security vulnerability (GHSA-x5pq-m9p8-f4vx) regarding dirkeys and filekeys
  • Introduced CSP nonces for JavaScript to enhance XSS defense
  • Added CBZ reader 'go-to-page' functionality
  • Added `--ftp-banner` option
  • Added volume flags for readme/logue display

Breaking Changes

  • CSP nonces introduced for JavaScript, which may break some existing javascript-based plugins
  • Default behavior for markdown/logue sandboxes may now be safer to disable

New Features

  • CSP nonces enforcement for JavaScript
  • Bwrap sandbox for ffmpeg/ffprobe
  • CBZ reader page navigation
  • Volume flags: `plainreadme`, `plainlogues`, `no_readme`, `no_logues`
  • U2C mode to calculate wark from stdin
  • Markdown history option (`--md-nhist`)
  • Directory sort-order edgecase fixes

Full Release Notes

<img src="https://github.com/9001/copyparty/raw/hovudstraum/docs/logo.svg" width="250" align="right"/>

* read-only demo server at https://a.ocv.me/pub/demo/
* [docker image](https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker) β•± [similar software](https://github.com/9001/copyparty/blob/hovudstraum/docs/versus.md) β•± [client testbed](https://cd.ocv.me/b/)

there is a [discord server](https://discord.gg/25J8CdTT6G) with an `@everyone` in case of future important updates, such as [vulnerabilities](https://github.com/9001/copyparty/security) (most recently 2026-07-06)

## ⚠️ ATTN: this release fixes a dirkey vulnerability

in volumes with **both** [dirkeys](https://github.com/9001/copyparty/#dirkeys) and [filekeys](https://github.com/9001/copyparty/#filekeys) enabled (default-disabled), a valid filekey could be converted into a dirkey, granting read-access to the containing folder

## recent important news

* [v1.20.17 (2026-07-06)](https://github.com/9001/copyparty/releases/tag/v1.20.17) fixed a vuln when a volume has both filekeys and dirkeys enabled
* [v1.20.17 (2026-07-06)](https://github.com/9001/copyparty/releases/tag/v1.20.17) introduced csp nonces, possibly breaking some javascript-based plugins

## πŸ§ͺ new features

* enforce csp nonces on javascript (additional xss defense) d3b95994
  * this could *possibly* break some aftermarket javascript-based plugins ([--js-browser](https://copyparty.eu/cli/#g-js-browser) / [--html-head](https://copyparty.eu/cli/#g-html-head))
  * now probably safe to disable the markdown/logue sandboxes ([--no-sb-md](https://copyparty.eu/cli/#g-no-sb-md) / `--no-sb-lg`) in most deployments, avoiding #230
* sandbox ffmpeg/ffprobe in bwrap to defend against future FFmpeg vulns efa43f89 85be3b8d
  * doesn't work in docker / podman, so `initcfg` in the images have [use-bwrap: n](https://copyparty.eu/cli/#g-use-bwrap) to disable it db68353e
  * doesn't work in [prisonparty](https://github.com/9001/copyparty/blob/hovudstraum/bin/prisonparty.sh) either... pain peko
* #1535 cbz-reader: go-to-page (thx @romfir!) 12d877b0
* volflags `plainreadme` and `plainlogues` to show readmes/logues as plaintext 9fa950bc
* volflags for `no_readme` and `no_logues` (previously global-only) 379c0aa6
* u2c: new mode to calculate wark from data on stdin 90639de9
* #1504 `--ftp-banner` 8242e693

## 🩹 bugfixes

* GHSA-x5pq-m9p8-f4vx (dir/filekey confusion) (thx @poolcritter!) e4075533
* fix resuming xbu-relocated partial uploads 5beecd66
* fix resuming partial uploads after server restart 22c3a3dd
* openbsd: fix signal masking for custom signals a00bc93f
* #1119 #1528 fix directory sort-order edgecases (thx @NecRaul!) d33d1132
* #1526 fix [--rotf-tz](https://copyparty.eu/cli/#g-rotf-tz); was effectively volflag-only (thx @NecRaul!) e017b1bc

## πŸ”§ other changes

* ffmpeg: remove lots of obscure codecs and formats for improved security 4c820301
* textfile-editor: some tweaks to the autobackup feature;
  * option [--md-nhist](https://copyparty.eu/cli/#g-md-nhist) to limit the number of old versions to keep 34c856e8
  * browsing old versions is now default-disabled; [--show-hist](https://copyparty.eu/cli/#g-show-hist) reenables it fa1499ae
* #1512 web-ui: if mkdir fails because folder already exists, then just cd into it 5dbff4af
* #1519 sftp: reduce excessive spam from portscanners 8c4e9313
* make database corruption more obvious on startup (usually due to broken server filesystem/hardware) be31a744
* docker:
  * #1532 add LABELs for version and creationtime 32d074ff
  * updated the [image compatibility matrix](https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker#editions) c3eb9ece
    * the `iv` image is no longer available for arm32 / armv6 6e75faa6

## 🌠 fun facts

* contains patches powered by [seventhrun - the ill shit](https://www.youtube.com/watch?v=_QW8mY663Ho&list=PLBO2h-GzDvIYRmupTCAasjzDjNxvjG639&index=12) + the rest of basschasers2 on [the Oslo-Bergen line](https://a.ocv.me/pub/g/2026/07/PXL_20260702_190436425b.jpg?cache), 1110 masl
* to those who celebrate, happy 6/7

----

# πŸ’Ύ what to download?
| download link | is it good? | description |
| -- | -- | -- |
| **[copyparty-sfx.py](https://github.com/9001/copyparty/releases/latest/download/copyparty-sfx.py)** | βœ… the best πŸ‘ | runs anywhere! only needs python |
| [copyparty-en.py](https://github.com/9001/copyparty/releases/latest/download/copyparty-en.py) | βœ… also good | same but english-only, no i18n |
| [a docker image](https://github.com/9001/copyparty/blob/hovudstraum/scripts/docker/README.md) | it's ok | good if you prefer docker πŸ‹ |
| [copyparty.exe](https://github.com/9001/copyparty/releases/latest/download/copyparty.exe) |  ⚠️ [acceptable](https://github.com/9001/copyparty#copypartyexe) | for [win8](https://user-images.githubusercontent.com/241032/221445946-1e328e56-8c5b-44a9-8b9f-dee84d942535.png) or later; built-in thumbnailer |
| [u2c.exe](https://github.com/9001/copyparty/releases/download/v1.20.17/u2c.exe) | ⚠️ acceptable | [CLI uploader](https://github.com/9001/copyparty/blob/hovudstraum/bin/u2c.py) as a win7+ exe ([video](https://a.ocv.me/pub/demo/pics-vids/u2cli.webm)) |
| [copyparty.pyz](https://github.com/9001/copyparty/releases/latest/download/copyparty.pyz) | ⚠️ acceptable | similar to the regular sfx, [mostly worse](https://github.com/9001/copyparty#zipapp) |
| [copyparty-en.pyz](https://github.com/9001/copyparty/releases/latest/download/copyparty-en.pyz) | ⚠️ acceptable | english-only, no smb-server |
| [copyparty32.exe](https://github.com/9001/copyparty/releases/latest/download/copyparty32.exe) | ⛔️ [dangerous](https://github.com/9001/copyparty#copypartyexe) | for [win7](https://user-images.githubusercontent.com/241032/221445944-ae85d1f4-d351-4837-b130-82cab57d6cca.png) -- never expose to the internet! |
| [cpp-winpe64.exe](https://github.com/9001/copyparty/releases/download/v1.16.5/copyparty-winpe64.exe) | ⛔️ dangerous | runs on [64bit WinPE](https://user-images.githubusercontent.com/241032/205454984-e6b550df-3c49-486d-9267-1614078dd0dd.png), otherwise useless |
| [bootable usb](https://a.ocv.me/pub/stuff/edcd001/enterprise-edition/) | ┐(οΎŸβˆ€οΎŸ)β”Œ | a surprisingly useful joke (x86_64) |

* except for [u2c.exe](https://github.com/9001/copyparty/releases/download/v1.20.17/u2c.exe), all of the options above are mostly equivalent
* the zip and tar.gz files below are just source code
* python packages are available at [PyPI](https://pypi.org/project/copyparty/#files)