CVE-2025-54796
Copyparty is vulnerable to Regex Denial of Service (ReDoS) attacks through "Recent Uploads" page
Copyparty is a portable file server. Versions prior to 1.18.9, the filter parameter for the "Recent Uploads" page allows arbitrary RegExes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks the server. This is fixed in version 1.18.9.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Copyparty is vulnerable to Regex Denial of Service (ReDoS) attacks through "Recent Uploads" page
Copyparty is a portable file server. Versions prior to 1.18.9, the filter parameter for the "Recent Uploads" page allows arbitrary RegExes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks the server. This is fixed in version 1.18.9.
- Record
CVE-2025-54796- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-1333, CWE-833
- Updated
- 2026-11-02
EUVDEUVD-2025-23411
Copyparty is a portable file server. Versions prior to 1.18.9, the filter parameter for the "Recent Uploads" page allows arbitrary RegExes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks the server. This is fixed in version 1.18.9.
- Record
EUVD-2025-23411- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-5662-2rj7-f2v6
copyparty allows Regex Denial of Service (ReDoS) in the upload listing
Summary
The filter parameter for the "Recent uploads" page allows arbitrary Regexes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks the server.
PoC
https://127.0.0.1:3923/?ru&filter=(.+)+x
Impact
The server becomes fully inaccessible for a long time.
- Record
GHSA-5662-2rj7-f2v6- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333
- Updated
- 2026-11-02
NVD
Copyparty is a portable file server. Versions prior to 1.18.9, the filter parameter for the "Recent Uploads" page allows arbitrary RegExes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks the server. This is fixed in version 1.18.9.
- Record
CVE-2025-54796- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-833, CWE-1333
- Updated
- 2026-11-02
OSV
Copyparty is vulnerable to Regex Denial of Service (ReDoS) attacks through "Recent Uploads" page
Copyparty is a portable file server. Versions prior to 1.18.9, the filter parameter for the "Recent Uploads" page allows arbitrary RegExes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks the server. This is fixed in version 1.18.9.
- Record
CVE-2025-54796- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333, CWE-400, CWE-833
- Updated
- 2026-11-02
OSVGHSA-5662-2rj7-f2v6
copyparty allows Regex Denial of Service (ReDoS) in the upload listing
Summary
The filter parameter for the "Recent uploads" page allows arbitrary Regexes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks the server.
PoC
https://127.0.0.1:3923/?ru&filter=(.+)+x
Impact
The server becomes fully inaccessible for a long time.
- Record
GHSA-5662-2rj7-f2v6- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333
- Updated
- 2026-11-02
OSVPYSEC-2026-1275
copyparty allows Regex Denial of Service (ReDoS) in the upload listing
Summary
The filter parameter for the "Recent uploads" page allows arbitrary Regexes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks the server.
PoC
https://127.0.0.1:3923/?ru&filter=(.+)+x
Impact
The server becomes fully inaccessible for a long time.
- Record
PYSEC-2026-1275- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
copypartyPyPI |
through 1.18.8 | 1.18.9 |
copypartyPyPI |
before 1.18.9, plus listed versions 0.10.00.10.10.10.100.10.110.10.12 Show 45 moreShow less0.10.130.10.140.10.150.10.160.10.170.10.180.10.190.10.20.10.200.10.210.10.220.10.30.10.40.10.50.10.60.10.70.10.80.10.90.11.00.11.10.11.100.11.110.11.120.11.130.11.140.11.150.11.160.11.170.11.180.11.190.11.200.11.210.11.220.11.230.11.240.11.260.11.270.11.280.11.290.11.300.11.310.11.320.11.330.11.340.11.35 |
1.18.9 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-54796 is a high vulnerability (CVSS 7.5) in 9001 Copyparty, published August 1, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 42nd percentile. Fixed in copyparty 1.18.9.
References
github.com/9001/copyparty/security/advisories/GHSA-5662-2rj7-f2v6
nvd.nist.gov/vuln/detail/CVE-2025-54796
pypi.org/project/copyparty
Left out here: 280 versions. The JSON record has them.