CVE-2026-27948Medium· 5.4▾ SunlitCopyparty vulnerable to reflected XSS via setck parameter
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.2%
0.2% → 0.3%
An XSS allows for reflected cross-site scripting via URL-parameter ?setck=...
A reflected cross-site scripting (XSS) vulnerability could allow an attacker to execute malicious javascript by tricking users into accessing a malicious link.
The worst-case outcome of this is being able to move or delete existing files on the server, or upload new files, using the account of the person who clicks the malicious link.
All attempted attacks (successful or not) would be logged to both the copyparty serverlog and the accesslog of the reverseproxy, and are detected by grep -E '[?&]setck=[^&"]*%' (the text setck= eventually followed by the % character).
copyparty < 1.20.9Upgrade to a patched release:
copyparty 1.20.9Connected by shared product, vendor, weakness, or advisory.
CVE-2023-37474High· 7.5copyparty vulnerable to path traversal attack
CVE-2023-41471High· 7.8Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to t…
CVE-2026-30974Medium· 4.6copyparty: volflag `nohtml` did not block javascript in svg files
CVE-2025-58753Mediumcopyparty: Sharing a single file does not fully restrict access to other files in source folder
CVE-2025-27145Low· 3.6copyparty renders unsanitized filenames as HTML when user uploads empty files
CVE-2025-54423Medium· 5.4copyparty has DOM-Based XSS vulnerability when displaying multimedia metadata