CVE-2023-41471High· 7.8▾ TwilightCross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to the WEEKEND-PLANS function. NOTE: this is disputed because WEEKEND-PLANS is accessible only to actors…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.2%
0.2% → 0.3%
Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to the WEEKEND-PLANS function. NOTE: this is disputed because WEEKEND-PLANS is accessible only to actors who already have write access to the server, and they can more simply upload HTML files containing JavaScript.
copyparty <= 1.9.1Refer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.
CVE-2023-37474High· 7.5copyparty vulnerable to path traversal attack
CVE-2026-30974Medium· 4.6copyparty: volflag `nohtml` did not block javascript in svg files
CVE-2026-27948Medium· 5.4Copyparty vulnerable to reflected XSS via setck parameter
CVE-2025-58753Mediumcopyparty: Sharing a single file does not fully restrict access to other files in source folder
CVE-2025-27145Low· 3.6copyparty renders unsanitized filenames as HTML when user uploads empty files
CVE-2025-54423Medium· 5.4copyparty has DOM-Based XSS vulnerability when displaying multimedia metadata