Vulnerabilities

TI-2026-71225 CVE-2026-104102 · GHSA-phv8-wgjp-g4p9

Path traversal in copyparty FTP uploads creates files outside volumes

LOW 24

copyparty is a portable file server.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00313 Published 2026-10-12 Fixed in 1.20.19 CWE-22

TI-2026-62941 CVE-2026-93353 · GHSA-3465-46r4-pj75

copyparty SFTP Volume Restriction Bypass via mkdir/rmdir/chattr Handlers

MEDIUM 45

copyparty contains a volume restriction bypass vulnerability in its SFTP front end that allows authenticated SFTP users to create, remove, and truncate arbitrary paths outside permitted volume boundaries by exploiting th…

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00274 Published 2026-09-24 No fix listed CWE-424

TI-2026-49358 CVE-2026-70657 · GHSA-x5pq-m9p8-f4vx

Copyparty: file/dirkey confusion

LOW 20

Copyparty is a portable file server.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00331 Published 2026-08-18 Fixed in 1.20.17 CWE-863

TI-2026-24647 CVE-2026-32109 · GHSA-rcp6-88mm-9vgf

Copyparty has unexpected JavaScript execution via crafted URL to folder with `.prologue.html`

LOW 20

Copyparty is a portable file server.

CVSS 3.1MEDIUM 4.4 Network Low privileges User interaction EPSS 0.00187 Published 2026-03-11 Fixed in 1.20.12 CWE-79

TI-2026-24646 CVE-2026-32108 · GHSA-67rw-2x62-mqqm

Copyparty ftp/sftp: Sharing a single file did not fully restrict source-folder access

LOW 12

Copyparty is a portable file server.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00309 Published 2026-03-11 Fixed in 1.20.12 CWE-863

TI-2026-23798 CVE-2026-30974 · GHSA-m6hv-x64c-27mm

Copyparty volflag `nohtml` did not block javascript in svg files

LOW 25

Copyparty is a portable file server.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00385 Published 2026-03-10 Fixed in 1.20.11 CWE-79

TI-2026-22292 CVE-2026-27948 · GHSA-62cr-6wp5-q43h

Copyparty vulnerable to eflected cross-site scripting via setck parameter

LOW 27

Copyparty is a portable file server.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00196 Published 2026-02-26 Fixed in 1.20.9 CWE-79

TI-2025-36411 CVE-2025-58753 · GHSA-pxvw-4w88-6x95

copyparty: Sharing a single file does not fully restrict access to other files in source folder

LOW 24

Copyparty is a portable file server.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00377 Published 2025-09-09 Fixed in 1.19.8 CWE-552

TI-2023-21990 CVE-2023-41471 · GHSA-4mcf-c9v4-fpcr

Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to…

HIGH 69

Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to the WEEKEND-PLANS function.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00272 Published 2025-08-29 No fix listed CWE-79

TI-2025-34551 CVE-2025-54796 · GHSA-5662-2rj7-f2v6

Copyparty is vulnerable to Regex Denial of Service (ReDoS) attacks through "Recent Uploads" page

HIGH 72

Copyparty is a portable file server.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00495 Published 2025-08-01 Fixed in 1.18.9 CWE-1333

TI-2025-34360 CVE-2025-54589 · GHSA-8mx2-rjh8-q3jq

copyparty Reflected XSS via Filter Parameter

LOW 33

Copyparty is a portable file server.

CVSS 3.1MEDIUM 6.3 Network No auth User interaction EPSS 0.02375 Published 2025-07-31 Fixed in 1.18.7 CWE-79

TI-2025-34228 CVE-2025-54423 · GHSA-9q4r-x2hj-jmvr

copyparty has a DOM-Based XSS vulnerability when displaying multimedia metadata

MEDIUM 60

copyparty is a portable file server.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00472 Published 2025-07-28 Fixed in 1.18.5 CWE-79

TI-2025-20002 CVE-2025-27145 · GHSA-m2jw-cj8v-937r

copyparty renders unsanitized filenames as HTML when user uploads empty files

MEDIUM 60

copyparty, a portable file server, has a DOM-based cross-site scripting vulnerability in versions prior to 1.16.15.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00469 Published 2025-02-25 Fixed in 1.16.15 CWE-79

TI-2023-19881 CVE-2023-38501 · GHSA-f54q-j679-p9hh

copyparty vulnerable to reflected cross-site scripting via k304 parameter

MEDIUM 61

copyparty is file server software.

CVSS 3.1MEDIUM 6.3 Network No auth User interaction EPSS 0.09246 Published 2023-07-25 Fixed in 1.8.7 CWE-79

TI-2023-19082 CVE-2023-37474 · GHSA-pxfv-7rr3-2qjg

Path traversal in copyparty

HIGH 72

Copyparty is a portable file server.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.4492 Published 2023-07-14 Fixed in 1.8.2 CWE-22

Vulnerabilities

Filters