CVSS 3.1
6.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2025-54589
Copyparty is a portable file server. In versions 1.18.6 and below, when accessing the recent uploads page at `/?ru`, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which reflects its value directly into a `<script>` block without proper escaping, allowing for reflected Cross-Site Scripting (XSS) and can be exploited against both authenticated and unauthenticated users. This is fixed in version 1.18.7.
Severity
- EPSS
- 2.4% chance of exploitation in the next 30 days; higher than 83% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-79, CWE-80
- Published
- Modified
- Record from
- the NVD, synced
Affected
- 9001:copyparty
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-8mx2-rjh8-q3jq | PyPI | copyparty | <1.18.7 | 1.18.7 |
| PYSEC-2026-1276 | PyPI | copyparty | <1.18.7 | 1.18.7 |