CVE-2025-54589

🗓️ 31 Jul 2025 13:48:41Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 56 Views🌐 WEB

Copyparty v1.18.6 and below has reflected XSS via filter parameter on recent uploads page. Fixed in v1.18.7.

Reporter	Title	Published	Views	Family All 19
githubexploit	Exploit for CVE-2025-54589	31 Jul 202521:47	–	githubexploit
circl	CVE-2025-54589	30 Jul 202522:10	–	circl
cnnvd	Copyparty 安全漏洞	31 Jul 202500:00	–	cnnvd
cvelist	CVE-2025-54589 copyparty Reflected XSS via Filter Parameter	31 Jul 202513:48	–	cvelist
exploitdb	Copyparty 1.18.6 - Reflected Cross-Site Scripting (XSS)	3 Aug 202500:00	–	exploitdb
euvd	EUVD-2025-23272	3 Oct 202520:07	–	euvd
github	copyparty Reflected XSS via Filter Parameter	31 Jul 202513:48	–	github
nuclei	Copyparty <=1.18.6 - Cross-Site Scripting	16 Jul 202609:41	–	nuclei
nvd	CVE-2025-54589	31 Jul 202514:15	–	nvd
osv	CVE-2025-54589 copyparty Reflected XSS via Filter Parameter	31 Jul 202513:48	–	osv

NVD

Vulners

Node

9001 copypartyRange<1.18.7

[
  {
    "vendor": "9001",
    "product": "copyparty",
    "versions": [
      {
        "version": "< 1.18.7",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/9001/copyparty/security/advisories/GHSA-8mx2-rjh8-q3jq
github	www.github.com/9001/copyparty/commit/a8705e611d05eeb22be5d3d7d9ab5c020fe54c62
github	www.github.com/9001/copyparty/releases/tag/v1.18.7

Parameter	Position	Path	Description	CWE
filter	query param	/?filter=	Reflected XSS vulnerability in Copyparty 1.18.6 via filter parameter on the recent uploads page, where the input is inserted into HTML without proper escaping.	CWE-79, CWE-80

17 Jun 2026 09:40Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.16.1 - 6.3

EPSS0.02393

SSVC