9001 Copyparty vulnerabilities

CVE-2023-37474 [HIGH] CWE-22 CVE-2023-37474: Copyparty is a portable file server. Versions prior to 1.8.2 are subject to a path traversal vulnera Copyparty is a portable file server. Versions prior to 1.8.2 are subject to a path traversal vulnerability detected in the `.cpr` subfolder. The Path Traversal attack technique allows an attacker access to files, directories, and commands that reside outside the web document root directory. This issue has been addressed in commit `043e3c7d` which has b

CVE-2023-38501 [MEDIUM] CWE-79 CVE-2023-38501: copyparty is file server software. Prior to version 1.8.7, the application contains a reflected cros copyparty is file server software. Prior to version 1.8.7, the application contains a reflected cross-site scripting via URL-parameter `?k304=...` and `?setck=...`. The worst-case outcome of this is being able to move or delete existing files on the server, or upload new files, using the account of the person who clicks the malicious link. It is reco

CVE-2025-54589 [MEDIUM] CWE-79 CVE-2025-54589: Copyparty is a portable file server. In versions 1.18.6 and below, when accessing the recent uploads Copyparty is a portable file server. In versions 1.18.6 and below, when accessing the recent uploads page at `/?ru`, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which reflects its value directly into a `` block without proper escaping, allowing for reflected Cross-Site Scripting (XSS

CVE-2025-58753 [HIGH] CWE-552 CVE-2025-58753: Copyparty is a portable file server. In versions prior to 1.19.8, there was a missing permission-che Copyparty is a portable file server. In versions prior to 1.19.8, there was a missing permission-check in the shares feature (the `shr` global-option). When a share was created for just one file inside a folder, it was possible to access the other files inside that folder by guessing the filenames. It was not possible to descend into subdirectories in

CVE-2025-54796 [HIGH] CWE-400 CVE-2025-54796: Copyparty is a portable file server. Versions prior to 1.18.9, the filter parameter for the "Recent Copyparty is a portable file server. Versions prior to 1.18.9, the filter parameter for the "Recent Uploads" page allows arbitrary RegExes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks the server. This is fixed in version 1.18.9.

CVE-2026-32108 [MEDIUM] CVE-2026-32108: Copyparty is a portable file server. Prior to 1.20.12, there was a missing permission-check in the s Copyparty is a portable file server. Prior to 1.20.12, there was a missing permission-check in the shares feature (the shr global-option). This vulnerability only applies when the shares feature is used for the specific purpose of creating a share of just a single file inside a folder or either the FTP or SFTP server is enabled, and also made publicly acces

CVE-2023-41471 [HIGH] CWE-79 CVE-2023-41471: Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbi Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to the WEEKEND-PLANS function. NOTE: this is disputed because WEEKEND-PLANS is accessible only to actors who already have write access to the server, and they can more simply upload HTML files containing JavaScript.

CVE-2025-54423 [MEDIUM] CWE-79 CVE-2025-54423: copyparty is a portable file server. In versions up to and including versions 1.18.4, an unauthentic copyparty is a portable file server. In versions up to and including versions 1.18.4, an unauthenticated attacker is able to execute arbitrary JavaScript code in a victim's browser due to improper sanitization of multimedia tags in music files, including m3u files. This is fixed in version 1.18.5.

CVE-2026-30974 [MEDIUM] CWE-79 CVE-2026-30974: Copyparty is a portable file server. Prior to v1.20.11., the nohtml config option, intended to preve Copyparty is a portable file server. Prior to v1.20.11., the nohtml config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG images. A user with write-permission could upload an SVG containing embedded JavaScript, which would execute in the context of whichever user opens it. This has been fixed in

CVE-2025-27145 [MEDIUM] CWE-79 CVE-2025-27145: copyparty, a portable file server, has a DOM-based cross-site scripting vulnerability in versions pr copyparty, a portable file server, has a DOM-based cross-site scripting vulnerability in versions prior to 1.16.15. The vulnerability is considered low-risk. By handing someone a maliciously-named file, and then tricking them into dragging the file into copyparty's Web-UI, an attacker could execute arbitrary javascript with the same privileges as tha

CVE-2026-27948 [MEDIUM] CWE-79 CVE-2026-27948: Copyparty is a portable file server. In versions prior to 1.20.9, an XSS allows for reflected cross- Copyparty is a portable file server. In versions prior to 1.20.9, an XSS allows for reflected cross-site scripting via URL-parameter `?setck=...`. Version 1.20.9 fixes the issue.

CVE-2026-32109 [MEDIUM] CWE-79 CVE-2026-32109: Copyparty is a portable file server. Prior to 1.20.12, if an attacker has been given both read- and Copyparty is a portable file server. Prior to 1.20.12, if an attacker has been given both read- and write-permissions to the server, they can upload a malicious file with the filename .prologue.html and then craft a link to potentially execute arbitrary JavaScript in the victim's context. Note that it is intended behavior that the JavaScript would exe