{"id":"CVE-2025-54589","aliases":["GHSA-8mx2-rjh8-q3jq","PYSEC-2026-1276"],"title":"copyparty Reflected XSS via Filter Parameter","summary":"copyparty Reflected XSS via Filter Parameter","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","vendor":"copyparty","product":"copyparty","ecosystem":"pip","affected":["copyparty < 1.18.7"],"patched":["copyparty 1.18.7"],"published":"2025-07-31","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-8mx2-rjh8-q3jq","references":[{"url":"https://github.com/9001/copyparty/security/advisories/GHSA-8mx2-rjh8-q3jq"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54589"},{"url":"https://github.com/9001/copyparty/commit/a8705e611d05eeb22be5d3d7d9ab5c020fe54c62"},{"url":"https://github.com/9001/copyparty"},{"url":"https://github.com/9001/copyparty/releases/tag/v1.18.7"}],"tags":["osv","pip","exploit-available"],"epss":0.0242,"epssPercentile":0.83317,"exploitAvailable":true,"ingestedAt":"2026-07-08T18:25:47.524Z","exploits":{"exploitdb":true,"github":1,"githubRepos":["https://github.com/byteReaper77/CVE-2025-54589"],"nuclei":["CVE-2025-54589"],"checkedAt":"2026-09-21T15:27:27.580Z"},"slug":"CVE-2025-54589","body":"## Overview\n\n### Summary\nUnauthorized reflected Cross-Site-Scripting when accessing the URL for recent uploads with the `filter` parameter containing JavaScript code.\n\n### Details\nWhen accessing the recent uploads page at `/?ru`, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which reflects its value directly into a `<script>` block without proper escaping.\nThis vulnerability allows for reflected Cross-Site Scripting (XSS) and can be exploited against both authenticated and unauthenticated users, enabling unwanted actions in the victims browser.\n\n### PoC\nA URL like this will execute `alert(1)`:\n```\nhttps://127.0.0.1:3923/?ru&filter=</script><script>alert(1)</script>\n```\n\n## Affected packages\n\n- `copyparty < 1.18.7`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `copyparty 1.18.7`","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":34.7,"likelihood":0.5,"exploitation":12,"ransomware":0},"changes":[]}