CVE-2025-54796: copyparty Regex Denial of Service Vulnerability
Summary
CVE-2025-54796: copyparty allows Regex Denial of Service (ReDoS) in the upload listing. Affects copyparty versions < 1.18.9. Fixed in 1.18.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
copyparty is an open-source file sharing application that allows users to upload and share files over the internet. It features a 'Recent uploads' page where users can filter uploads using regular expressions. This functionality, while powerful, introduces a significant risk if not properly managed, as it can be exploited to cause server unavailability.
Vulnerability Detail
The vulnerability arises from the 'filter' parameter on the 'Recent uploads' page, which permits arbitrary regular expressions. When this feature is enabled (which is the default setting), an attacker can craft a regex pattern that leads to a deadlock situation on the server. This results in the server becoming fully inaccessible for an extended period, severely impacting service availability. The technical nature of this vulnerability falls under the category of Regular Expression Denial of Service (ReDoS), where complex regex patterns can consume excessive resources.
How To Fix
Latest published version: 1.20.26 as of 22 Oct 2026
pip install --upgrade "copyparty==1.20.26"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.18.9
This is the first release that contains the fix.
pip install --upgrade "copyparty==1.18.9"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the 'filter' feature on the 'Recent uploads' page to prevent exploitation until the package is updated. This can usually be done by modifying the configuration settings in your application.
Conclusion
In summary, the copyparty application has a significant vulnerability that allows for regex-based denial of service attacks. It is crucial for users to update to the patched version to mitigate risks. Additionally, temporary workarounds can be implemented to enhance security until the update is applied.
See every vulnerability recorded for copyparty →
FAQ
The vulnerability allows for the creation of arbitrary regex patterns that can lead to server deadlocks, making the service unavailable.
If you are using copyparty version 1.18.8 or earlier, your application is vulnerable. You can check your version using 'pip show copyparty'.
The primary impact is service unavailability, which can disrupt user access to the file sharing service and affect overall user experience.
Yes, you can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software without requiring access to the code or installation.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for copyparty.
