Vulnerability · Published Jul 31, 2025 · Assigned by GitHub_M

CVE-2025-54589copyparty Reflected XSS via Filter Parameter

Medium 6.3

In plain English

A medium-severity cross-site scripting in copyparty from 9001. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)2.4%top 16.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling2Nuclei, Public PoC

Official description

Copyparty is a portable file server. In versions 1.18.6 and below, when accessing the recent uploads page at `/?ru`, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which reflects its value directly into a `<script>` block without proper escaping, allowing for reflected Cross-Site Scripting (XSS) and can be exploited against both authenticated and unauthenticated users. This is fixed in version 1.18.7.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	copyparty	1.18.7	GHSA-8mx2-rjh8-q3jq
PyPI	copyparty	1.18.7	PYSEC-2026-1276

Affected products (as reported)

Vendor	Product	Versions
9001	copyparty	< 1.18.7

Weakness: CWE-79, CWE-80 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

References

https://github.com/9001/copyparty/security/advisories/GHSA-8mx2-rjh8-q3jq x_refsource_CONFIRM
https://github.com/9001/copyparty/commit/a8705e611d05eeb22be5d3d7d9ab5c020fe54c62 x_refsource_MISC
https://github.com/9001/copyparty/releases/tag/v1.18.7 x_refsource_MISC