CVE-2025-54589: copyparty Reflected XSS via Filter Parameter
Summary Unauthorized reflected Cross-Site-Scripting when accessing the URL for recent uploads with the filter parameter containing JavaScript code.
Details When accessing the recent uploads page at /?ru, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which reflects its value directly into a <script> block without proper escaping. This vulnerability allows for reflected Cross-Site Scripting (XSS) and can be exploited against both authenticated and unauthenticated users, enabling unwanted actions in the victims browser.
PoC A URL like this will execute alert(1): https://127.0.0.1:3923/?ru&filter=</script><script>alert(1)</script>
Other sources
Copyparty is a portable file server. In versions 1.18.6 and below, when accessing the recent uploads page at /?ru, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which reflects its value directly into a <script> block without proper escaping, allowing for reflected Cross-Site Scripting (XSS) and can be exploited against both authenticated and unauthenticated users. This is fixed in version 1.18.7.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54589?
CVE-2025-54589 is considered a high severity vulnerability due to the potential for unauthorized Cross-Site Scripting (XSS) attacks.
How do I fix CVE-2025-54589?
To mitigate CVE-2025-54589, upgrade the copyparty package to version 1.18.7 or later.
What is Cross-Site Scripting in the context of CVE-2025-54589?
In the context of CVE-2025-54589, Cross-Site Scripting refers to the vulnerability that allows attackers to inject malicious scripts via the filter parameter.
Which versions of copyparty are affected by CVE-2025-54589?
CVE-2025-54589 affects copyparty versions up to and including 1.18.6.
Where can I find more information about CVE-2025-54589?
More information about CVE-2025-54589 can be found in security advisories related to the copyparty project.