PYSEC-2026-2136

vendorUSosv

view advisory published 2026-02-26Licence: CC-BY-4.0

Copyparty is a portable file server. In versions prior to 1.20.9, an XSS allows for reflected cross-site scripting via URL-parameter `?setck=...`. Version 1.20.9 fixes the issue.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-27948US	medium6.1	0.20% (9th)	—	2026-02-26
Copyparty is a portable file server. In versions prior to 1.20.9, an XSS allows for reflected cross-site scripting via URL-parameter `?setck=...`. Version 1.20.9 fixes the issue.

references

External citations — patches, advisories, analysis.

https://github.com/9001/copyparty/commit/31b2801fd041f803f4a3d5c12c7d7cb5419048bcFIX
https://github.com/9001/copyparty/security/advisories/GHSA-62cr-6wp5-q43hADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan