PYSEC-2025-240

vendorUSosv

view advisory published 2025-08-29Licence: CC-BY-4.0

Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to the WEEKEND-PLANS function. NOTE: this is disputed because WEEKEND-PLANS is accessible only to actors who already have write access to the server, and they can more simply upload HTML files containing JavaScript.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-41471US	—	0.26% (18th)	—	2025-08-29
Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to the WEEKEND-PLANS function. NOTE: this is di…

references

External citations — patches, advisories, analysis.

https://github.com/9001/copypartyPACKAGE
https://github.com/9001/copyparty/releases/tag/v1.9.2WEB
https://github.com/Trinity-SYT-SECURITY/XSS_vuln_issue/blob/main/copyparty.mdEVIDENCE

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan