CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2025-54796
High (7.5) in 9001 copyparty. EPSS 0.5% chance of exploitation in the next 30 days. Fixed in copyparty 1.18.9.
Copyparty is a portable file server. Versions prior to 1.18.9, the filter parameter for the "Recent Uploads" page allows arbitrary RegExes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks the server. This is fixed in version 1.18.9.
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 39% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-400, CWE-833, CWE-1333
- Published
- Modified
- Record from
- the NVD, synced
Affected
- 9001:copyparty
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-5662-2rj7-f2v6 | PyPI | copyparty | <1.18.9 | 1.18.9 |
| PYSEC-2026-1275 | PyPI | copyparty | <1.18.9 | 1.18.9 |