CVE-2025-54589 copyparty Reflected XSS via Filter Parameter
Attackers can execute arbitrary scripts in victim browsers via the filter parameter on the recent uploads page, affecting both authenticated and unauthenticated users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-54589?
CVE-2025-54589 is a medium-severity cross-site scripting vulnerability in 9001 copyparty, published on 31 Jul 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Copyparty is a portable file server. In versions 1.18.6 and below, when accessing the recent uploads page at `/?ru`, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which reflects its value directly into a `<script>` block without proper escaping, allowing for reflected Cross-Site Scripting (XSS) and can be exploited against both authenticated and unauthenticated users. This is fixed in version 1.18.7.
Which versions are affected by CVE-2025-54589?
3 open source packages ship an affected version, including copyparty. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
copyparty PyPI | All versions | 1.18.7 |
copyparty PyPI | All versions | 1.18.7 |
copyparty PyPI | All versions | 1.18.7 |
Products include 9001 Copyparty.
How do I fix CVE-2025-54589?
Upgrade copyparty to 1.18.7 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-54589 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-54589 exists.
Public exploit code: 1 Exploit-DB entry, 1 Nuclei template and 1 proofs of concept on GitHub.
Other vulnerabilities in 9001 copyparty
- CVE-2023-41471 Cross-site scripting in n/a
- CVE-2025-54796 Copyparty is vulnerable to Regex Denial of Service (ReDoS) attacks through "Recent Uploads" page
- CVE-2023-37474 Path traversal in copyparty
- CVE-2023-38501 copyparty vulnerable to reflected cross-site scripting via k304 parameter
- CVE-2026-27948 Copyparty vulnerable to eflected cross-site scripting via setck parameter
Sources
Also known as GHSA-8mx2-rjh8-q3jq, PYSEC-2026-1276.