CVE-2025-54589: copyparty Reflected XSS via Filter Parameter
Summary
CVE-2025-54589: copyparty Reflected XSS via Filter Parameter. Affects copyparty versions < 1.18.7. Fixed in 1.18.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
copyparty is an open-source file sharing application that allows users to upload and share files over the web. It features a user-friendly interface and supports various file types. However, it has a vulnerability that allows for reflected Cross-Site Scripting (XSS) attacks, which can compromise user security.
Vulnerability Detail
The vulnerability arises from the improper handling of user input in the filter parameter on the recent uploads page. When users access this page, they can input a filter that is directly reflected in a script block without proper escaping. This flaw enables attackers to inject malicious JavaScript code, which can be executed in the browser of any user accessing the manipulated URL. This can lead to unauthorized actions, data theft, or session hijacking.
How To Fix
Latest published version: 1.20.26 as of 22 Oct 2026
pip install --upgrade "copyparty==1.20.26"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.18.7
This is the first release that contains the fix.
pip install --upgrade "copyparty==1.18.7"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the filter parameter in the URL until the package is updated. If you must use it, ensure that the input is sanitized and validated to prevent the execution of malicious scripts.
Conclusion
The copyparty application has a reflected XSS vulnerability due to improper handling of user input in the filter parameter. It is crucial to update to version 1.18.7 or later to protect against potential attacks. Users should also be cautious and avoid using the vulnerable parameter until the update is applied.
See every vulnerability recorded for copyparty →
FAQ
Reflected XSS is a type of security vulnerability where an attacker injects malicious scripts into a web application, which then reflects the script back to the user's browser without proper validation or escaping.
Both authenticated and unauthenticated users of the copyparty application are at risk of being affected by this vulnerability.
You can use the Vulert playground to check if your application is affected by this vulnerability without any signup. Visit Vulert Scanner to get started.
The CVSS score of this vulnerability is 6.3, indicating a moderate severity level.
If you cannot update the package right away, avoid using the filter parameter in the URL and ensure that any user input is properly sanitized to mitigate the risk of XSS attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for copyparty.
