---
id: CVE-2025-54589
aliases:
  - GHSA-8mx2-rjh8-q3jq
  - PYSEC-2026-1276
title: copyparty Reflected XSS via Filter Parameter
summary: copyparty Reflected XSS via Filter Parameter
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L'
vendor: copyparty
product: copyparty
ecosystem: pip
affected:
  - copyparty < 1.18.7
patched:
  - copyparty 1.18.7
published: '2025-07-31'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-8mx2-rjh8-q3jq'
references:
  - url: 'https://github.com/9001/copyparty/security/advisories/GHSA-8mx2-rjh8-q3jq'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-54589'
  - url: >-
      https://github.com/9001/copyparty/commit/a8705e611d05eeb22be5d3d7d9ab5c020fe54c62
  - url: 'https://github.com/9001/copyparty'
  - url: 'https://github.com/9001/copyparty/releases/tag/v1.18.7'
tags:
  - osv
  - pip
  - exploit-available
epss: 0.0242
epssPercentile: 0.83445
exploitAvailable: true
ingestedAt: '2026-07-08T18:25:47.524Z'
exploits:
  exploitdb: true
  github: 1
  githubRepos:
    - 'https://github.com/byteReaper77/CVE-2025-54589'
  nuclei:
    - CVE-2025-54589
  checkedAt: '2026-09-23T07:13:37.117Z'
---

## Overview

### Summary
Unauthorized reflected Cross-Site-Scripting when accessing the URL for recent uploads with the `filter` parameter containing JavaScript code.

### Details
When accessing the recent uploads page at `/?ru`, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which reflects its value directly into a `<script>` block without proper escaping.
This vulnerability allows for reflected Cross-Site Scripting (XSS) and can be exploited against both authenticated and unauthenticated users, enabling unwanted actions in the victims browser.

### PoC
A URL like this will execute `alert(1)`:
```
https://127.0.0.1:3923/?ru&filter=</script><script>alert(1)</script>
```

## Affected packages

- `copyparty < 1.18.7`

## Remediation

Upgrade to a patched release:

- `copyparty 1.18.7`