copyparty version history

- Added shadowing feature with `//NULL` to unmap volumes from server filesystem - Fixed false-positive warning on startup - Disabled bwrap ffmpeg sandbox by default due to compatibility issues - Improved logfile rotation and thumbnail expiration handling

- Fixed a dirkey vulnerability when both filekeys and dirkeys are enabled - Introduced CSP nonces for additional XSS defense (may break some plugins) - Added sandboxing for ffmpeg/ffprobe to improve security - New features include CBZ reader page navigation and volume flags for plaintext readmes/logues

- Improved OPDS compatibility and added support for s6 service notification protocol - Users with read-access can now create get-only shares - Added logarithmic frequency scale option for music spectrograms and fixed various bugs - Docker improvements including arm32 build graduation and switch to libraw for better thumbnail quality

<img src="https://github.com/9001/copyparty/raw/hovudstraum/docs/logo.svg" width="250" align="right"/> * read-only demo server at https://a.ocv.me/pub/demo/ * [docker image](https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker) ╱ [similar software](https://github.com/9001/copyparty/blob/hovudstraum/docs/versus.md) ╱ [client testbed](https://cd.ocv.me/b/) there is a [discord server](https://discord.gg/25J8CdTT6G) with an `@everyone` in case of future important updates, such as [vulnerabilities](https://github.com/9001/copyparty/security) (most recently 2026-03-08) ## recent important news * [v1.20.9 (2026-02-25)](https://github.com/9001/copyparty/releases/tag/v1.20.9) fixed [CVE-2026-27948](https://github.com/9001/copyparty/security/advisories/GHSA-62cr-6wp5-q43h) (XSS) ## 🧪 new features * #1410 #376 #1224 new option `--glang` to autoselect UI-translation based on webbrowser's language (thx @stackxp!) ec3e0e7e * #1407 #1384 option to automatically switch between list-view and grid-view depending on folder contents (thx @icxes!) 822fa718 660ed7a9 961a2737 * #1447 audioplayer can now play bcstm / bfstm / brstm files (nintendo 3ds/wii bgm) 3a9ff67a

<img src="https://github.com/9001/copyparty/raw/hovudstraum/docs/logo.svg" width="250" align="right"/> * read-only demo server at https://a.ocv.me/pub/demo/ * [docker image](https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker) ╱ [similar software](https://github.com/9001/copyparty/blob/hovudstraum/docs/versus.md) ╱ [client testbed](https://cd.ocv.me/b/) there is a [discord server](https://discord.gg/25J8CdTT6G) with an `@everyone` in case of future important updates, such as [vulnerabilities](https://github.com/9001/copyparty/security) (most recently 2026-03-08) ## recent important news * [v1.20.9 (2026-02-25)](https://github.com/9001/copyparty/releases/tag/v1.20.9) fixed [CVE-2026-27948](https://github.com/9001/copyparty/security/advisories/GHSA-62cr-6wp5-q43h) (XSS) ## 🧪 new features * #1351 add [.hidden](https://github.com/9001/copyparty/#dothidden) support (thx @NecRaul!) beb634dc 134e378e * cosmetic filter to exclude specific files from directory listings by adding their filenames to a textfile named `.hidden` similar to many linux desktop file managers * the files are still easily available from various APIs; this is **not** a security

<img src="https://github.com/9001/copyparty/raw/hovudstraum/docs/logo.svg" width="250" align="right"/> * read-only demo server at https://a.ocv.me/pub/demo/ * [docker image](https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker) ╱ [similar software](https://github.com/9001/copyparty/blob/hovudstraum/docs/versus.md) ╱ [client testbed](https://cd.ocv.me/b/) there is a [discord server](https://discord.gg/25J8CdTT6G) with an `@everyone` in case of future important updates, such as [vulnerabilities](https://github.com/9001/copyparty/security) (most recently 2026-03-08) ## ⚠️ ATTN: this release fixes an ftp/sftp issue with shares * [GHSA-67rw-2x62-mqqm](https://github.com/9001/copyparty/security/advisories/GHSA-67rw-2x62-mqqm): when a share is created for just one or more files inside a folder, it was possible to use FTP or SFTP to access the other files inside that folder by guessing the filenames * so ignore this issue if you did not enable [ftp](https://copyparty.eu/cli/#g-ftp) or [sftp](https://copyparty.eu/cli/#g-sftp) in the server config * it was not possible to descend into subdirectories in this manner; only the sibling files were accessible * NOTE:

<img src="https://github.com/9001/copyparty/raw/hovudstraum/docs/logo.svg" width="250" align="right"/> * read-only demo server at https://a.ocv.me/pub/demo/ * [docker image](https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker) ╱ [similar software](https://github.com/9001/copyparty/blob/hovudstraum/docs/versus.md) ╱ [client testbed](https://cd.ocv.me/b/) there is a [discord server](https://discord.gg/25J8CdTT6G) with an `@everyone` in case of future important updates, such as [vulnerabilities](https://github.com/9001/copyparty/security) (most recently 2026-03-08) ## ⚠️ ATTN: this release fixes a vulnerability [GHSA-m6hv-x64c-27mm](https://github.com/9001/copyparty/security/advisories/GHSA-m6hv-x64c-27mm) the `nohtml` volflag did not prevent javascript inside SVG images from executing -- a malicious user with write-access could upload an SVG file which would execute as javascript when someone opens it 1c9f894e ## recent important news * [v1.20.9 (2026-02-25)](https://github.com/9001/copyparty/releases/tag/v1.20.9) fixed [CVE-2026-27948](https://github.com/9001/copyparty/security/advisories/GHSA-62cr-6wp5-q43h) (XSS) ## 🧪 new features * version-

<img src="https://github.com/9001/copyparty/raw/hovudstraum/docs/logo.svg" width="250" align="right"/> * read-only demo server at https://a.ocv.me/pub/demo/ * [docker image](https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker) ╱ [similar software](https://github.com/9001/copyparty/blob/hovudstraum/docs/versus.md) ╱ [client testbed](https://cd.ocv.me/b/) there is a [discord server](https://discord.gg/25J8CdTT6G) with an `@everyone` in case of future important updates, such as [vulnerabilities](https://github.com/9001/copyparty/security) (most recently 2026-02-25) ## recent important news * [v1.20.9 (2026-02-25)](https://github.com/9001/copyparty/releases/tag/v1.20.9) fixed [CVE-2026-27948](https://github.com/9001/copyparty/security/advisories/GHSA-62cr-6wp5-q43h) (XSS) ## 🩹 bugfixes * #1311 fix login (broke in v1.20.9) ecdfd2d1 ## 🔧 other changes * warn that config-reload doesn't do global-options a29037a0 ## 🌠 fun facts * rushing out a cve-fix in the wee hours of the morning before the 9-5 is a great idea that never goes wrong * 10/10 will probably do again ---- ## ⚠️ not the [latest version](https://github.com/9001/copyparty

<img src="https://github.com/9001/copyparty/raw/hovudstraum/docs/logo.svg" width="250" align="right"/> * read-only demo server at https://a.ocv.me/pub/demo/ * [docker image](https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker) ╱ [similar software](https://github.com/9001/copyparty/blob/hovudstraum/docs/versus.md) ╱ [client testbed](https://cd.ocv.me/b/) there is a [discord server](https://discord.gg/25J8CdTT6G) with an `@everyone` in case of future important updates, such as [vulnerabilities](https://github.com/9001/copyparty/security) (most recently 2026-02-25) ## ⚠️ ATTN: this release fixes an XSS vulnerability [GHSA-62cr-6wp5-q43h](https://github.com/9001/copyparty/security/advisories/GHSA-62cr-6wp5-q43h) could let an attacker execute arbitrary JS by tricking you into clicking a malicious link 31b2801f # known issue: login broken, fix roughly 8pm UTC tonight ## 🔧 other changes * webdav: [dav-port](https://copyparty.eu/cli/#g-dav-port) can be used as an alternative to [daw](https://copyparty.eu/cli/#g-daw) d21242fc ---- ## ⚠️ not the [latest version](https://github.com/9001/copyparty/releases/latest/)!

<img src="https://github.com/9001/copyparty/raw/hovudstraum/docs/logo.svg" width="250" align="right"/> * read-only demo server at https://a.ocv.me/pub/demo/ * [docker image](https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker) ╱ [similar software](https://github.com/9001/copyparty/blob/hovudstraum/docs/versus.md) ╱ [client testbed](https://cd.ocv.me/b/) there is a [discord server](https://discord.gg/25J8CdTT6G) with an `@everyone` in case of future important updates, such as [vulnerabilities](https://github.com/9001/copyparty/security) (most recently 2025-09-07) ## 🧪 new features * #1298 add Hungarian translation (thx @sonacl!) eefb181b f37c3b96 * #1299 chown now accepts 4-digit values (thx @new-sashok724!) 5a7504fd ## 🩹 bugfixes * audioplayer skip-silence: * #1303 clamp ffwd to safe values (thx @icxes!) f5e70c7f * fix crash on folderchange f1a433a6 ## 🔧 other changes * due to [legal reasons](https://github.com/9001/copyparty/blob/hovudstraum/docs/bad-codecs.md), the [docker-images](https://github.com/9001/copyparty/blob/hovudstraum/scripts/docker) and [bootable flashdrive](https://a.ocv.me/pub/stuff/edcd001/enterprise-edition/) are

<img src="https://github.com/9001/copyparty/raw/hovudstraum/docs/logo.svg" width="250" align="right"/> * read-only demo server at https://a.ocv.me/pub/demo/ * [docker image](https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker) ╱ [similar software](https://github.com/9001/copyparty/blob/hovudstraum/docs/versus.md) ╱ [client testbed](https://cd.ocv.me/b/) there is a [discord server](https://discord.gg/25J8CdTT6G) with an `@everyone` in case of future important updates, such as [vulnerabilities](https://github.com/9001/copyparty/security) (most recently 2025-09-07) ## 🧪 new features * now possible to upload/delete files while the filesystem-indexer is still busy d44ea245 0ca4c1bd * global-option [fika](https://copyparty.eu/cli/#g-fika) decides which actions to allow while still indexing; default is upload+copy+delete * full deduplication is only guaranteed if this option is set blank, as dupes are allowed while indexing * #1266 browsers can request thumbnails as jxl images, and view jxl files in the gallery (thx @intelfx!) b2711e05 720c83b2 93ffc65c a65a30b1 a7a25deb 59de5e2c 16403d8c 48c10178 0e8913c2 * only works in browsers which support jxl, w

<img src="https://github.com/9001/copyparty/raw/hovudstraum/docs/logo.svg" width="250" align="right"/> * read-only demo server at https://a.ocv.me/pub/demo/ * [docker image](https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker) ╱ [similar software](https://github.com/9001/copyparty/blob/hovudstraum/docs/versus.md) ╱ [client testbed](https://cd.ocv.me/b/) there is a [discord server](https://discord.gg/25J8CdTT6G) with an `@everyone` in case of future important updates, such as [vulnerabilities](https://github.com/9001/copyparty/security) (most recently 2025-09-07) ## 🧪 new features * #1264 now possible to grant the `get` permission when creating a share 95b827f1 * the button was already there, but until now it did nothing ## 🩹 bugfixes * a safeguard (24141b49) added in [v1.20.5](https://github.com/9001/copyparty/releases/tag/v1.20.5) was too strict and would block requests from certain reverseproxies, specifically anything that adds `X-Forwarded-HTTP-Version` 72224d29 ---- ## ⚠️ not the [latest version](https://github.com/9001/copyparty/releases/latest/)!