CVE-2025-54796High· 7.5▾ Twilightcopyparty allows Regex Denial of Service (ReDoS) in the upload listing
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.4%
Last analysed / modified upstream
0.4% → 0.4%
The filter parameter for the "Recent uploads" page allows arbitrary Regexes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks the server.
https://127.0.0.1:3923/?ru&filter=(.+)+x
The server becomes fully inaccessible for a long time.
copyparty < 1.18.9Upgrade to a patched release:
copyparty 1.18.9Connected by shared product, vendor, weakness, or advisory.
CVE-2023-37474High· 7.5copyparty vulnerable to path traversal attack
CVE-2023-41471High· 7.8Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to t…
CVE-2026-30974Medium· 4.6copyparty: volflag `nohtml` did not block javascript in svg files
CVE-2026-27948Medium· 5.4Copyparty vulnerable to reflected XSS via setck parameter
CVE-2025-58753Mediumcopyparty: Sharing a single file does not fully restrict access to other files in source folder
CVE-2025-27145Low· 3.6copyparty renders unsanitized filenames as HTML when user uploads empty files