CVE-2025-54589

copyparty Reflected XSS via Filter Parameter

Copyparty is a portable file server. In versions 1.18.6 and below, when accessing the recent uploads page at `/?ru`, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which reflects its value directly into a `<script>` block without proper escaping, allowing for reflected Cross-Site Scripting (XSS) and can be exploited against both authenticated and unauthenticated users. This is fixed in version 1.18.7.

Affected

9001 · copyparty

CVSS v3.1 NVD

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v3.1 GITHUB

6.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

EPSS

2.38% chance of exploitation in the next 30 days, 84th percentile

Nuclei

medium · CWE-79

Published

2025-07-31

Proof-of-concept exploits (2)

• 9001/copyparty/security/advisories/GHSA-8mx2-rjh8-q3jq
• byteReaper77/CVE-2025-545892★ · 2025-08-01

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-54589.yaml

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/52390

Security advisories

• advisories/GHSA-8mx2-rjh8-q3jq
• 9001/copyparty/commit/a8705e611d05eeb22be5d3d7d9ab5c020fe54c62

References

• CVE Record
• NVD entry

Related

• CVE-2022-0847
• CVE-2024-4577
• CVE-2025-10046
• CVE-2025-11077
• CVE-2025-2783
• CVE-2025-32429