152 matches found
Copyparty <=1.18.6 - Cross-Site Scripting
Copyparty before 1.18.7 is vulnerable to reflected cross-site scripting XSS via the 'filter' parameter in the '/?ru' endpoint. Unsanitized user input is reflected in the HTML response, allowing attackers to execute arbitrary JavaScript in the context of the victim's browser. id: CVE-2025-54589...
CopyParty v1.8.6 - Cross Site Scripting
Copyparty is a portable file server. Versions prior to 1.8.6 are subject to a reflected cross-site scripting XSS Attack.Vulnerability that exists in the web interface of the application could allow an attacker to execute malicious javascript code by tricking users into accessing a malicious link...
Copyparty <= 1.8.2 - Directory Traversal
Copyparty is a portable file server. Versions prior to 1.8.2 are subject to a path traversal vulnerability detected in the .cpr subfolder. The Path Traversal attack technique allows an attacker access to files, directories, and commands that reside outside the web document root directory. This...
CVE-2025-54589
CVE-2025-54589 – Copyparty 反射型 XSS 作者： Byte Reaper 描述： 该仓库提供了一个针对 CVE-2025-54589 的概念验证（PoC）和简单利用程序，该漏洞是 Copyparty ≤ 1.18.6 中的一个反射型跨站脚本（XSS）漏洞。 通过将精心构造的 JavaScript 载荷注入到 filter 参数中，该工具能够自动检测漏洞并记录成功的反射结果。 功能特性： 支持 HTTP 和 HTTPS 目标 可选的自定义 cookie 和 CA 文件支持 自动颜色检测 （终端支持，可使用 --no-color 禁用） 详细...
CVE-2026-70657
Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the containing folder. This vulnerability was only reachable if both...
GHSA-X5PQ-M9P8-F4VX Copyparty vulnerable to file/dirkey confusion
A valid filekey could potentially be converted into a dirkey, granting read-access to the containing folder. This issue only affected volumes which simultaneously enable both filekeys and dirkeys, with volflag dk or dks combined with fk or fka. Both required features are default-disabled, and mus...
Copyparty vulnerable to file/dirkey confusion
A valid filekey could potentially be converted into a dirkey, granting read-access to the containing folder. This issue only affected volumes which simultaneously enable both filekeys and dirkeys, with volflag dk or dks combined with fk or fka. Both required features are default-disabled, and mus...
EUVD-2026-60949
Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the containing folder even though both features are disabled by defau...
CVE-2026-70657
Copyparty , a portable file server, is affected by a file/dirkey confusion vulnerability prior to version 1.20.17 . When a volume has both directory-key flags (dk/dks) and file-key flags (fk/fka) simultaneously enabled, a valid file key can be converted into a directory key, granting read access ...
CVE-2026-70657 Copyparty: file/dirkey confusion
Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the containing folder. This vulnerability was only reachable if both...
CVE-2026-70657 Copyparty: file/dirkey confusion
Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the containing folder. This vulnerability was only reachable if both...
CVE-2026-70657
Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the containing folder even though both features are disabled by defau...
PT-2026-77147
Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the containing folder even though both features are disabled by defau...
copyparty allows Regex Denial of Service (ReDoS) in the upload listing
SummaryThe filter parameter for the "Recent uploads" page allows arbitrary Regexes. If this feature is enabled which is the default, an attacker can craft a filter which deadlocks the server. PoChttps://127.0.0.1:3923/?ru=.++x ImpactThe server becomes fully inaccessible for a long time...
PYSEC-2026-1277 copyparty has DOM-Based XSS vulnerability when displaying multimedia metadata
Summary An unauthenticated attacker is able to execute arbitrary JavaScript code in a victim's browser due to improper sanitization of multimedia tags in music files, including m3u files. Details Multimedia metadata is rendered in the web-app without sanitization. This can be exploited in two way...
PYSEC-2026-1278 copyparty renders unsanitized filenames as HTML when user uploads empty files
Summary A DOM-Based XSS was discovered in copyparty, a portable fileserver. The vulnerability is considered low-risk. Details By handing someone a maliciously-named file, and then tricking them into dragging the file into copyparty's Web-UI, an attacker could execute arbitrary javascript with the...
CVE-2026-32109
Copyparty is a portable file server. Prior to 1.20.12, if an attacker has been given both read- and write-permissions to the server, they can upload a malicious file with the filename .prologue.html and then craft a link to potentially execute arbitrary JavaScript in the victim's context. Note th...
CVE-2026-32108
Copyparty is a portable file server. Prior to 1.20.12, there was a missing permission-check in the shares feature the shr global-option. This vulnerability only applies when the shares feature is used for the specific purpose of creating a share of just a single file inside a folder or either the...
CVE-2026-30974
Copyparty is a portable file server. Prior to v1.20.11., the nohtml config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG images. A user with write-permission could upload an SVG containing embedded JavaScript, which would execute in the...