CVE-2025-54796
highpriority · track · 0EPSS 0.005 · 40 %ileEUUSEPSS · scored 2026-10-27
Copyparty is a portable file server. Versions prior to 1.18.9, the filter parameter for the "Recent Uploads" page allows arbitrary RegExes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks the server. This is fixed in version 1.18.9.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-5662-2rj7-f2v6copyparty allows Regex Denial of Service (ReDoS) in the upload listing2025-08-04ghsa · osvUS
### Summary The `filter` parameter for the "Recent uploads" page allows arbitrary Regexes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks the server. ### PoC `https://127.0.0.1:3923/?ru&filter=(.+)+x` ### Impact The server becomes fully inaccessible for a long time.
- PYSEC-2026-1275copyparty allows Regex Denial of Service (ReDoS) in the upload listing2026-07-07vendor · osvUS
### Summary The `filter` parameter for the "Recent uploads" page allows arbitrary Regexes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks the server. ### PoC `https://127.0.0.1:3923/?ru&filter=(.+)+x` ### Impact The server becomes fully inaccessible for a long time.
also known as (6)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (11)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2025-54796cnnvd
- https://github.com/9001/copyparty/commit/09910ba80784c3980947d92f45db696398c0fd83cnnvd
- https://github.com/9001/copyparty/releases/tag/v1.18.9cnnvd
- https://github.com/9001/copyparty/security/advisories/GHSA-5662-2rj7-f2v6cnnvd
- https://github.com/9001/copyparty/tagsPatchcnnvd
- https://github.com/9001/copyparty/commit/09910ba80784c3980947d92f45db696398c0fd83enisa_euvd
- https://github.com/9001/copyparty/releases/tag/v1.18.9enisa_euvd
- https://github.com/9001/copyparty/security/advisories/GHSA-5662-2rj7-f2v6enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan