Cross-site Scripting (XSS)

copyparty is vulnerable to Cross-site Scripting XSS. The vulnerability exists because the txsvcs function of httpcli.py does not properly escape malicious characters, which allows an attacker to inject and execute malicious javascript by providing a malicious URL containing ?hc= with somewhere in...

Path Traversal

copyparty is vulnerable to Path Traversal. The vulnerability exists because the library does not properly validate the .cpr endpoint in httpcli.py, allowing an attacker to access files outside the expected directory and read arbitrary files through relative paths such as \..filename...