---
id: CVE-2025-54796
aliases:
  - GHSA-5662-2rj7-f2v6
  - PYSEC-2026-1275
title: copyparty allows Regex Denial of Service (ReDoS) in the upload listing
summary: copyparty allows Regex Denial of Service (ReDoS) in the upload listing
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
vendor: copyparty
product: copyparty
ecosystem: pip
affected:
  - copyparty < 1.18.9
patched:
  - copyparty 1.18.9
published: '2025-08-04'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:26.743035993Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-5662-2rj7-f2v6'
references:
  - url: 'https://github.com/9001/copyparty/security/advisories/GHSA-5662-2rj7-f2v6'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-54796'
  - url: >-
      https://github.com/9001/copyparty/commit/09910ba80784c3980947d92f45db696398c0fd83
  - url: 'https://github.com/9001/copyparty'
  - url: 'https://github.com/9001/copyparty/releases/tag/v1.18.9'
tags:
  - osv
  - pip
epss: 0.00417
epssPercentile: 0.3335
ingestedAt: '2026-07-08T18:25:45.793Z'
---

## Overview

### Summary
The `filter` parameter for the "Recent uploads" page allows arbitrary Regexes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks the server.

### PoC
`https://127.0.0.1:3923/?ru&filter=(.+)+x`

### Impact
The server becomes fully inaccessible for a long time.

## Affected packages

- `copyparty < 1.18.9`

## Remediation

Upgrade to a patched release:

- `copyparty 1.18.9`