CVE-2025-54796: Copyparty is vulnerable to Regex Denial of Service (ReDoS) attacks through "Recent Uploads" page
Summary The filter parameter for the "Recent uploads" page allows arbitrary Regexes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks the server.
PoC https://127.0.0.1:3923/?ru&filter=(.+)+x
Impact The server becomes fully inaccessible for a long time.
Other sources
Copyparty is a portable file server. Versions prior to 1.18.9, the filter parameter for the "Recent Uploads" page allows arbitrary RegExes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks the server. This is fixed in version 1.18.9.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54796?
CVE-2025-54796 has a moderate severity as it can lead to server deadlock due to arbitrary RegExes being executed.
How do I fix CVE-2025-54796?
To fix CVE-2025-54796, you need to upgrade to Copyparty version 1.18.9 or later.
What is the impact of CVE-2025-54796?
The impact of CVE-2025-54796 is that it allows an attacker to create a filter that can deadlock the server, causing service disruption.
Which versions are affected by CVE-2025-54796?
CVE-2025-54796 affects all versions of Copyparty prior to version 1.18.9.
Is the filter parameter feature in Copyparty safe to use?
The filter parameter feature in Copyparty is unsafe by default in versions prior to 1.18.9, as it allows for arbitrary RegEx execution.