---
id: CVE-2023-41471
aliases:
  - PYSEC-2025-240
title: >-
  Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local
  attacker to execute arbitrary code via a crafted payload to t…
summary: >-
  Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local
  attacker to execute arbitrary code via a crafted payload to the WEEKEND-PLANS
  function. NOTE: this is disputed because WEEKEND-PLANS is accessible only to
  actors…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
vendor: copyparty
product: copyparty
ecosystem: pip
affected:
  - copyparty <= 1.9.1
published: '2025-08-29'
updated: '2026-07-13'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/PYSEC-2025-240'
references:
  - url: 'https://github.com/9001/copyparty/releases/tag/v1.9.2'
  - url: 'https://github.com/9001/copyparty'
  - url: >-
      https://github.com/Trinity-SYT-SECURITY/XSS_vuln_issue/blob/main/copyparty.md
tags:
  - osv
  - pip
epss: 0.00261
epssPercentile: 0.18254
ingestedAt: '2026-07-13T18:58:06.626Z'
---

## Overview

Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to the WEEKEND-PLANS function. NOTE: this is disputed because WEEKEND-PLANS is accessible only to actors who already have write access to the server, and they can more simply upload HTML files containing JavaScript.

## Affected packages

- `copyparty <= 1.9.1`

## Remediation

Refer to the advisory for the patched release.