Every CVESearch/Get API key

CVE-2025-54589

copyparty Reflected XSS via Filter Parameter

6.3 MediumPublic exploitFix available

CVE-2025-54589 is a medium vulnerability (CVSS 6.3) in 9001 Copyparty, published July 31, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.38%, the 84th percentile. Fixed in copyparty 1.18.7.

What does this mean?
Severity
6.3 MediumCVSS 3.1, CVE List
Exploit chance
2.38%EPSS, 84th percentile
Exploitation
None known3 public exploits
Fixed in
1.18.7copyparty +1 more

Description

Copyparty is a portable file server. In versions 1.18.6 and below, when accessing the recent uploads page at /?ru, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which reflects its value directly into a <script> block without proper escaping, allowing for reflected Cross-Site Scripting (XSS) and can be exploited against both authenticated and unauthenticated users. This is fixed in version 1.18.7.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

2.38%Up 2.3 points since Aug 1, 2025
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
copyparty
PyPI
through 1.18.6
1.18.7
copyparty
PyPI
before 1.18.7, plus listed versions
0.10.00.10.10.10.100.10.110.10.12
Show 45 moreShow less
0.10.130.10.140.10.150.10.160.10.170.10.180.10.190.10.20.10.200.10.210.10.220.10.30.10.40.10.50.10.60.10.70.10.80.10.90.11.00.11.10.11.100.11.110.11.120.11.130.11.140.11.150.11.160.11.170.11.180.11.190.11.200.11.210.11.220.11.230.11.240.11.260.11.270.11.280.11.290.11.300.11.310.11.320.11.330.11.340.11.35
1.18.7

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubbyteReaper77/CVE-2025-545892025-07-31
Exploit-DBCopyparty 1.18.6 - Reflected Cross-Site Scripting (XSS)2025-08-03
NucleiCopyparty <=1.18.6 - Cross-Site Scripting

What each source reports

CVE List Score used6.3

copyparty Reflected XSS via Filter Parameter

Copyparty is a portable file server. In versions 1.18.6 and below, when accessing the recent uploads page at /?ru, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which reflects its value directly into a <script> block without proper escaping, allowing for reflected Cross-Site Scripting (XSS) and can be exploited against both authenticated and unauthenticated users. This is fixed in version 1.18.7.

Record
CVE-2025-54589
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Weakness
CWE-79, CWE-80
Updated
2026-11-02
EUVDEUVD-2025-232726.3

Copyparty is a portable file server. In versions 1.18.6 and below, when accessing the recent uploads page at /?ru, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which reflects its value directly into a <script> block without proper escaping, allowing for reflected Cross-Site Scripting (XSS) and can be exploited against both authenticated and unauthenticated users. This is fixed in version 1.18.7.

Record
EUVD-2025-23272
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-8mx2-rjh8-q3jq6.3

copyparty Reflected XSS via Filter Parameter

Summary

Unauthorized reflected Cross-Site-Scripting when accessing the URL for recent uploads with the filter parameter containing JavaScript code.

Details

When accessing the recent uploads page at /?ru, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which reflects its value directly into a <script> block without proper escaping. This vulnerability allows for reflected Cross-Site Scripting (XSS) and can be exploited against both authenticated and unauthenticated users, enabling unwanted actions in the victims browser.

PoC

A URL like this will execute alert(1):

https://127.0.0.1:3923/?ru&filter=</script><script>alert(1)</script>
Record
GHSA-8mx2-rjh8-q3jq
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Weakness
CWE-79
Updated
2026-11-02
NVD6.3

Copyparty is a portable file server. In versions 1.18.6 and below, when accessing the recent uploads page at /?ru, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which reflects its value directly into a <script> block without proper escaping, allowing for reflected Cross-Site Scripting (XSS) and can be exploited against both authenticated and unauthenticated users. This is fixed in version 1.18.7.

Record
CVE-2025-54589
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79, CWE-80
Updated
2026-11-02
OSV6.3

copyparty Reflected XSS via Filter Parameter

Copyparty is a portable file server. In versions 1.18.6 and below, when accessing the recent uploads page at /?ru, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which reflects its value directly into a <script> block without proper escaping, allowing for reflected Cross-Site Scripting (XSS) and can be exploited against both authenticated and unauthenticated users. This is fixed in version 1.18.7.

Record
CVE-2025-54589
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Weakness
CWE-79, CWE-80
Updated
2026-11-11
OSVGHSA-8mx2-rjh8-q3jq6.3

copyparty Reflected XSS via Filter Parameter

Summary

Unauthorized reflected Cross-Site-Scripting when accessing the URL for recent uploads with the filter parameter containing JavaScript code.

Details

When accessing the recent uploads page at /?ru, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which reflects its value directly into a <script> block without proper escaping. This vulnerability allows for reflected Cross-Site Scripting (XSS) and can be exploited against both authenticated and unauthenticated users, enabling unwanted actions in the victims browser.

PoC

A URL like this will execute alert(1):

https://127.0.0.1:3923/?ru&filter=</script><script>alert(1)</script>
Record
GHSA-8mx2-rjh8-q3jq
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Weakness
CWE-79
Updated
2026-11-02
OSVPYSEC-2026-12766.3

copyparty Reflected XSS via Filter Parameter

Summary

Unauthorized reflected Cross-Site-Scripting when accessing the URL for recent uploads with the filter parameter containing JavaScript code.

Details

When accessing the recent uploads page at /?ru, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which reflects its value directly into a <script> block without proper escaping. This vulnerability allows for reflected Cross-Site Scripting (XSS) and can be exploited against both authenticated and unauthenticated users, enabling unwanted actions in the victims browser.

PoC

A URL like this will execute alert(1):

https://127.0.0.1:3923/?ru&filter=</script><script>alert(1)</script>
Record
PYSEC-2026-1276
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Updated
2026-11-02

History

History
RecordedChangedSources
exploits, factsOSV
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

This page doesn't list everything

Left out here: 278 versions. The JSON record has them.

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open