CVE-2026-27948: Copyparty Reflected XSS Vulnerability via setck Parameter
Summary
CVE-2026-27948: Copyparty vulnerable to reflected XSS via setck parameter. Affects copyparty versions < 1.20.9. Fixed in 1.20.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Copyparty is an open-source file sharing application that allows users to share files over the internet. It is built using Python and is designed to be lightweight and easy to use. However, like many web applications, it can be susceptible to security vulnerabilities, including cross-site scripting (XSS) attacks. This specific vulnerability allows attackers to exploit the application through a reflected XSS attack, which can lead to unauthorized actions being performed on behalf of the user.
Vulnerability Detail
The vulnerability arises from the handling of the 'setck' URL parameter, which is not properly sanitized. An attacker can craft a malicious link containing a script that, when clicked by a user, executes JavaScript in the context of the user's session. This could lead to severe consequences, such as unauthorized file manipulation or data theft. The vulnerability is classified as a reflected XSS, meaning the attack is executed immediately upon accessing the malicious link, without any persistent storage of the attack code.
How To Fix
Latest published version: 1.20.26 as of 22 Oct 2026
pip install --upgrade "copyparty==1.20.26"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.20.9
This is the first release that contains the fix.
pip install --upgrade "copyparty==1.20.9"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation and sanitization for the 'setck' parameter in your application to prevent the execution of malicious scripts. This can be done by encoding or stripping out any potentially harmful characters from the input before processing it.
Conclusion
The Copyparty application is vulnerable to a reflected XSS attack via the 'setck' parameter, which can lead to serious security issues. It is crucial to update to version 1.20.9 or later to mitigate this risk. Implementing input validation can serve as a temporary workaround while ensuring the application remains secure.
See every vulnerability recorded for copyparty →
FAQ
Reflected XSS is a type of cross-site scripting attack where the malicious script is reflected off a web server, typically via a URL parameter, and executed immediately in the user's browser.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can use the Vulert playground to test your application without any signup.
The potential impacts include unauthorized access to user accounts, file manipulation, and data theft, which can compromise the integrity and confidentiality of your application.
Yes, you can implement input validation and sanitization for the 'setck' parameter as a temporary measure until you can update to the patched version.
The CVSS score of this vulnerability is 5.4, indicating a moderate level of risk associated with it.
References
Related vulnerabilities
Recent vulnerabilities recorded for copyparty.
