winget install --id 9001.copypartyAbout copyparty
Portable file server with accelerated resumable uploads, dedup, WebDAV, FTP, TFTP, zeroconf, media indexer, thumbnails++ all in one file, no deps
What's new in 1.20.20
- v1.20.19 (2026-07-27) fixed an FTP-server vuln (upload outside defined volumes) - v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled - v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins 🧪 new features - #1574 #1585 wopi: probably support onlyoffice as wopi-client (thx @kamaeff!) fdf52a8c - #1580 wopi: --wopi-urls to choose a different wopi-client url based on current domain (thx @kamaeff!) 24a4090f - #634 #1033 #1390 correct size of volumes in directory listings (thx @vmattphillips!) 5c157be9 - #1577 thumbnails for krita .kra and openraster .ora images (thx @Wuerfel21!) 9f5f9d88 - hotkey F4 to reload/refresh the directory listing 2c6497b6 🩹 bugfixes - #1581 ctrl-a in search results 28801172 🔧 other changes - show an explanation in the web-UI if javascript is broken due to misconfigured hosting-stack (the "csp nonce" stuff) 6f924829 - improve upload performance when running behind a buggy or bufferbloating reverseproxy c0c638c9 - #1582 Nixos: fix version checker (thx @sylfn!) 63c61b67
Version history
| Version | Updated | Notes |
|---|---|---|
| 1.20.20 | Unknown | - v1.20.19 (2026-07-27) fixed an FTP-server vuln (upload outside defined volumes) - v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled - v1.20.17 (2026-07-06) introduced csp nonces, po... |
| 1.20.19 | Unknown | the FTP-server (default-disabled) would allow uploading to any folder that the copyparty process had permission to write to, but with certain limitations; see GHSA-phv8-wgjp-g4p9 recent important news - v1.20.19 (2026-07... |
| 1.20.18 | Unknown | - v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled - v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins 🧪 new features - shadowing: filesyst... |
| 1.20.17 | Unknown | in volumes with both dirkeys and filekeys enabled (default-disabled), a valid filekey could be converted into a dirkey, granting read-access to the containing folder recent important news - v1.20.17 (2026-07-06) fixed a... |
| 1.20.16 | Unknown | - v1.20.9 (2025-02-25) fixed CVE-2026-27948 (XSS) 🧪 new features - #1463 opds: improved compatibility with various clients (thx @kamaeff!) 9068ec6a - #1485 users with read-access can now create get-only shares (thx @Scot... |
| 1.20.14 | Unknown | - v1.20.9 (2025-02-25) fixed CVE-2026-27948 (XSS) 🧪 new features - #1410 #376 #1224 new option --glang to autoselect UI-translation based on webbrowser's language (thx @stackxp!) ec3e0e7e - #1407 #1384 option to automati... |
| 1.20.13 | Unknown | - v1.20.9 (2025-02-25) fixed CVE-2026-27948 (XSS) 🧪 new features - #1351 add .hidden support (thx @NecRaul!) beb634dc 134e378e - cosmetic filter to exclude specific files from directory listings by adding their filenames... |
| 1.20.12 | Unknown | - GHSA-67rw-2x62-mqqm: when a share is created for just one or more files inside a folder, it was possible to use FTP or SFTP to access the other files inside that folder by guessing the filenames - so ignore this issue... |
| 1.20.11 | Unknown | GHSA-m6hv-x64c-27mm the nohtml volflag did not prevent javascript inside SVG images from executing -- a malicious user with write-access could upload an SVG file which would execute as javascript when someone opens it 1c... |
| 1.20.10 | Unknown | - v1.20.9 (2025-02-25) fixed CVE-2026-27948 (XSS) 🩹 bugfixes - #1311 fix login (broke in v1.20.9) ecdfd2d1 🔧 other changes - warn that config-reload doesn't do global-options a29037a0 🌠fun facts - rushing out a cve-fix... |
| 1.20.9 | Unknown | GHSA-62cr-6wp5-q43h could let an attacker execute arbitrary JS by tricking you into clicking a malicious link 31b2801f 🔧 other changes - webdav: dav-port can be used as an alternative to daw d21242fc |
| 1.20.8 | Unknown | - #1298 add Hungarian translation (thx @sonacl!) eefb181b f37c3b96 - #1299 chown now accepts 4-digit values (thx @new-sashok724!) 5a7504fd 🩹 bugfixes - audioplayer skip-silence: - #1303 clamp ffwd to safe values (thx @ic... |
| 1.20.7 | Unknown | - now possible to upload/delete files while the filesystem-indexer is still busy d44ea245 0ca4c1bd - global-option fika decides which actions to allow while still indexing; default is upload+copy+delete - full deduplicat... |
| 1.20.6 | Unknown | - #1264 now possible to grant the get permission when creating a share 95b827f1 - the button was already there, but until now it did nothing 🩹 bugfixes - a safeguard (24141b49) added in v1.20.5 was too strict and would b... |
| 1.20.5 | Unknown | - #1240 webdav clients can now set fractional last-modified timestamps (thx @jcwillox!) 296362fc - #1260 add support for running the server with GraalPy (thx @vgskye!) 73d06eaf - #1182 pressing CTRL-C will copy links of... |
| 1.20.4 | Unknown | - #1235 rightclick-menu: fix creating new files/folders in gridview (thx @SpaceXCheeseWheel!) ffca67f2 🔧 other changes - #1229 updated the Esperanto translation (thx @slashdevslashurandom!) 1142ac25 - #1232 shares: if an... |
| 1.20.3 | Unknown | - send-message-to-serverlog now also available as url-parameter ?smsg=foo - option smsg configures which HTTP-methods to allow; can be set to GET,POST but default is only POST because GET is dangerous (CSRF) 🩹 bugfixes -... |
| 1.20.1 | Unknown | - read-only demo server at https://a.ocv.me/pub/demo/ - docker image ╱ similar software ╱ client testbed there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most rece... |
| 1.19.17 | Unknown | Release notes |