QwikSec

Security Database

CVE

CWE

Training

CVE-2025-54589

Published: Jul 31, 2025

Modified: Jul 31, 2025

PUBLISHED

CVSS v3.1

6.3

MEDIUM

Description

Copyparty is a portable file server. In versions 1.18.6 and below, when accessing the recent uploads page at `/?ru`, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which reflects its value directly into a `<script>` block without proper escaping, allowing for reflected Cross-Site Scripting (XSS) and can be exploited against both authenticated and unauthenticated users. This is fixed in version 1.18.7.

Vendor	Product	Versions
9001	copyparty	affected `< 1.18.7`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

References

https://github.com/9001/copyparty/security/advisories/GHSA-8mx2-rjh8-q3jq

x_refsource_CONFIRM

https://github.com/9001/copyparty/commit/a8705e611d05eeb22be5d3d7d9ab5c020fe54c62

x_refsource_MISC

https://github.com/9001/copyparty/releases/tag/v1.18.7

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.