CVE-2025-54589
Medium
Description
Copyparty is a portable file server. In versions 1.18.6 and below, when accessing the recent uploads page at `/?ru`, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which reflects its value directly into a `<script>` block without proper escaping, allowing for reflected Cross-Site Scripting (XSS) and can be exploited against both authenticated and unauthenticated users. This is fixed in version 1.18.7.
SeverityMedium
CVSS6.3
Exploit probability—
Product9001 Copyparty
PublishedJul 31, 2025
First seenJul 31, 2025
Weakness typeCWE-79Cross-site scripting (XSS)CWE-80CWE-80
How to fix
Update
- 9001 copyparty1.18.7 or later
- copyparty1.18.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| 9001 copyparty | v < 1.18.7 | 1.18.7 |
| copypartyPyPI | v < 1.18.7 | 1.18.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.