PyPI package
copyparty
pkg:pypi/copyparty
Vulnerabilities (11)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-32109 | — | < 1.20.12 | 1.20.12 | Mar 11, 2026 | Copyparty is a portable file server. Prior to 1.20.12, if an attacker has been given both read- and write-permissions to the server, they can upload a malicious file with the filename .prologue.html and then craft a link to potentially execute arbitrary JavaScript in the victim's | ||
| CVE-2026-32108 | — | < 1.20.12 | 1.20.12 | Mar 11, 2026 | Copyparty is a portable file server. Prior to 1.20.12, there was a missing permission-check in the shares feature (the shr global-option). This vulnerability only applies when the shares feature is used for the specific purpose of creating a share of just a single file inside a f | ||
| CVE-2026-30974 | — | < 1.20.11 | 1.20.11 | Mar 10, 2026 | Copyparty is a portable file server. Prior to v1.20.11., the nohtml config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG images. A user with write-permission could upload an SVG containing embedded JavaScript, which would ex | ||
| CVE-2026-27948 | — | < 1.20.9 | 1.20.9 | Feb 26, 2026 | Copyparty is a portable file server. In versions prior to 1.20.9, an XSS allows for reflected cross-site scripting via URL-parameter `?setck=...`. Version 1.20.9 fixes the issue. | ||
| CVE-2025-58753 | — | < 1.19.8 | 1.19.8 | Sep 9, 2025 | Copyparty is a portable file server. In versions prior to 1.19.8, there was a missing permission-check in the shares feature (the `shr` global-option). When a share was created for just one file inside a folder, it was possible to access the other files inside that folder by gues | ||
| CVE-2025-54796 | — | < 1.18.9 | 1.18.9 | Aug 1, 2025 | Copyparty is a portable file server. Versions prior to 1.18.9, the filter parameter for the "Recent Uploads" page allows arbitrary RegExes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks the server. This is fixed in version 1.18. | ||
| CVE-2025-54589 | — | < 1.18.7 | 1.18.7 | Jul 31, 2025 | Copyparty is a portable file server. In versions 1.18.6 and below, when accessing the recent uploads page at `/?ru`, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which reflects its value directly into a `` | ||
| CVE-2025-54423 | — | < 1.18.5 | 1.18.5 | Jul 28, 2025 | copyparty is a portable file server. In versions up to and including versions 1.18.4, an unauthenticated attacker is able to execute arbitrary JavaScript code in a victim's browser due to improper sanitization of multimedia tags in music files, including m3u files. This is fixed | ||
| CVE-2025-27145 | — | < 1.16.15 | 1.16.15 | Feb 25, 2025 | copyparty, a portable file server, has a DOM-based cross-site scripting vulnerability in versions prior to 1.16.15. The vulnerability is considered low-risk. By handing someone a maliciously-named file, and then tricking them into dragging the file into copyparty's Web-UI, an att | ||
| CVE-2023-38501 | — | < 1.8.7 | 1.8.7 | Jul 25, 2023 | copyparty is file server software. Prior to version 1.8.7, the application contains a reflected cross-site scripting via URL-parameter `?k304=...` and `?setck=...`. The worst-case outcome of this is being able to move or delete existing files on the server, or upload new files, u | ||
| CVE-2023-37474 | — | < 1.8.2 | 1.8.2 | Jul 14, 2023 | Copyparty is a portable file server. Versions prior to 1.8.2 are subject to a path traversal vulnerability detected in the `.cpr` subfolder. The Path Traversal attack technique allows an attacker access to files, directories, and commands that reside outside the web document root |
- CVE-2026-32109Mar 11, 2026affected < 1.20.12fixed 1.20.12
Copyparty is a portable file server. Prior to 1.20.12, if an attacker has been given both read- and write-permissions to the server, they can upload a malicious file with the filename .prologue.html and then craft a link to potentially execute arbitrary JavaScript in the victim's
- CVE-2026-32108Mar 11, 2026affected < 1.20.12fixed 1.20.12
Copyparty is a portable file server. Prior to 1.20.12, there was a missing permission-check in the shares feature (the shr global-option). This vulnerability only applies when the shares feature is used for the specific purpose of creating a share of just a single file inside a f
- CVE-2026-30974Mar 10, 2026affected < 1.20.11fixed 1.20.11
Copyparty is a portable file server. Prior to v1.20.11., the nohtml config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG images. A user with write-permission could upload an SVG containing embedded JavaScript, which would ex
- CVE-2026-27948Feb 26, 2026affected < 1.20.9fixed 1.20.9
Copyparty is a portable file server. In versions prior to 1.20.9, an XSS allows for reflected cross-site scripting via URL-parameter `?setck=...`. Version 1.20.9 fixes the issue.
- CVE-2025-58753Sep 9, 2025affected < 1.19.8fixed 1.19.8
Copyparty is a portable file server. In versions prior to 1.19.8, there was a missing permission-check in the shares feature (the `shr` global-option). When a share was created for just one file inside a folder, it was possible to access the other files inside that folder by gues
- CVE-2025-54796Aug 1, 2025affected < 1.18.9fixed 1.18.9
Copyparty is a portable file server. Versions prior to 1.18.9, the filter parameter for the "Recent Uploads" page allows arbitrary RegExes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks the server. This is fixed in version 1.18.
- CVE-2025-54589Jul 31, 2025affected < 1.18.7fixed 1.18.7
Copyparty is a portable file server. In versions 1.18.6 and below, when accessing the recent uploads page at `/?ru`, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which reflects its value directly into a ``
- CVE-2025-54423Jul 28, 2025affected < 1.18.5fixed 1.18.5
copyparty is a portable file server. In versions up to and including versions 1.18.4, an unauthenticated attacker is able to execute arbitrary JavaScript code in a victim's browser due to improper sanitization of multimedia tags in music files, including m3u files. This is fixed
- CVE-2025-27145Feb 25, 2025affected < 1.16.15fixed 1.16.15
copyparty, a portable file server, has a DOM-based cross-site scripting vulnerability in versions prior to 1.16.15. The vulnerability is considered low-risk. By handing someone a maliciously-named file, and then tricking them into dragging the file into copyparty's Web-UI, an att
- CVE-2023-38501Jul 25, 2023affected < 1.8.7fixed 1.8.7
copyparty is file server software. Prior to version 1.8.7, the application contains a reflected cross-site scripting via URL-parameter `?k304=...` and `?setck=...`. The worst-case outcome of this is being able to move or delete existing files on the server, or upload new files, u
- CVE-2023-37474Jul 14, 2023affected < 1.8.2fixed 1.8.2
Copyparty is a portable file server. Versions prior to 1.8.2 are subject to a path traversal vulnerability detected in the `.cpr` subfolder. The Path Traversal attack technique allows an attacker access to files, directories, and commands that reside outside the web document root