CVE-2025-54589
mediumPriorität · verfolgen · 35EPSS 0.024 · 84. PerzentilExploit · PoCEUUSEPSS · bewertet 2026-10-27
Copyparty is a portable file server. In versions 1.18.6 and below, when accessing the recent uploads page at `/?ru`, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which reflects its value directly into a `<script>` block without proper escaping, allowing for reflected Cross-Site Scripting (XSS) and can be exploited against both authenticated and unauthenticated users. This is fixed in version 1.18.7.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
Exploits (2)
Öffentlicher Proof-of-Concept- und Exploit-Code.
betroffene Produkte (3)
Betroffene Produkte und Versionsbereiche.
Advisories (2)
Hersteller- und Ökosystem-Meldungen dazu.
- GHSA-8mx2-rjh8-q3jqcopyparty Reflected XSS via Filter Parameter2025-07-31ghsa · osvUS
### Summary Unauthorized reflected Cross-Site-Scripting when accessing the URL for recent uploads with the `filter` parameter containing JavaScript code. ### Details When accessing the recent uploads page at `/?ru`, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which reflects its value directly into a `<script>` block without proper escaping. This vulnerability allows for reflected Cross-Site Scripting (XSS) and can be exploited against both authenticated and unauthenticated users, enabling unwanted actions in the victims browser. ### PoC A URL like this will execute `alert(1)`: ``` https://127.0.0.1:3923/?ru&filter=</script><script>alert(1)</script> ```
- PYSEC-2026-1276copyparty Reflected XSS via Filter Parameter2026-07-07vendor · osvUS
### Summary Unauthorized reflected Cross-Site-Scripting when accessing the URL for recent uploads with the `filter` parameter containing JavaScript code. ### Details When accessing the recent uploads page at `/?ru`, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which reflects its value directly into a `<script>` block without proper escaping. This vulnerability allows for reflected Cross-Site Scripting (XSS) and can be exploited against both authenticated and unauthenticated users, enabling unwanted actions in the victims browser. ### PoC A URL like this will execute `alert(1)`: ``` https://127.0.0.1:3923/?ru&filter=</script><script>alert(1)</script> ```
auch bekannt als (6)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (11)
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/9001/copyparty/commit/a8705e611d05eeb22be5d3d7d9ab5c020fe54c62cnnvd
- https://github.com/9001/copyparty/releasesPatchcnnvd
- https://github.com/9001/copyparty/releases/tag/v1.18.7cnnvd
- https://github.com/9001/copyparty/security/advisories/GHSA-8mx2-rjh8-q3jqcnnvd
- https://www.exploit-db.com/exploits/52390cnnvd
- https://github.com/9001/copyparty/commit/a8705e611d05eeb22be5d3d7d9ab5c020fe54c62enisa_euvd
- https://github.com/9001/copyparty/releases/tag/v1.18.7enisa_euvd
- https://github.com/9001/copyparty/security/advisories/GHSA-8mx2-rjh8-q3jqenisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan