CVE-2025-54589Medium· 6.3▾ TwilightPoC availablecopyparty Reflected XSS via Filter Parameter
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 34.7 · likelihood 0.5 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 3 sources. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
2.4%
2.4% → 2.4%
Exploit-DB · 1 GitHub repo · Nuclei ×1 (last check)
Unauthorized reflected Cross-Site-Scripting when accessing the URL for recent uploads with the filter parameter containing JavaScript code.
When accessing the recent uploads page at /?ru, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which reflects its value directly into a <script> block without proper escaping.
This vulnerability allows for reflected Cross-Site Scripting (XSS) and can be exploited against both authenticated and unauthenticated users, enabling unwanted actions in the victims browser.
A URL like this will execute alert(1):
https://127.0.0.1:3923/?ru&filter=</script><script>alert(1)</script>
copyparty < 1.18.7Upgrade to a patched release:
copyparty 1.18.7Connected by shared product, vendor, weakness, or advisory.
CVE-2023-37474High· 7.5copyparty vulnerable to path traversal attack
CVE-2023-41471High· 7.8Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to t…
CVE-2026-30974Medium· 4.6copyparty: volflag `nohtml` did not block javascript in svg files
CVE-2026-27948Medium· 5.4Copyparty vulnerable to reflected XSS via setck parameter
CVE-2025-58753Mediumcopyparty: Sharing a single file does not fully restrict access to other files in source folder
CVE-2025-27145Low· 3.6copyparty renders unsanitized filenames as HTML when user uploads empty files