CVE-2025-54796 Copyparty is vulnerable to Regex Denial of Service (ReDoS) attacks through "Recent Uploads" page
An attacker can cause a denial of service in Copyparty by submitting malicious regex filters to the Recent Uploads page.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-54796?
CVE-2025-54796 is a high-severity denial of service vulnerability in 9001 copyparty, published on 1 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Copyparty is a portable file server. Versions prior to 1.18.9, the filter parameter for the "Recent Uploads" page allows arbitrary RegExes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks the server. This is fixed in version 1.18.9.
Which versions are affected by CVE-2025-54796?
3 open source packages ship an affected version, including copyparty. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
copyparty PyPI | All versions | 1.18.9 |
copyparty PyPI | All versions | 1.18.9 |
copyparty PyPI | All versions | 1.18.9 |
Products include 9001 Copyparty.
How do I fix CVE-2025-54796?
Upgrade copyparty to 1.18.9 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-54796 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-54796 exists.
Other vulnerabilities in 9001 copyparty
- CVE-2023-41471 Cross-site scripting in n/a
- CVE-2023-37474 Path traversal in copyparty
- CVE-2025-54589 copyparty Reflected XSS via Filter Parameter
- CVE-2023-38501 copyparty vulnerable to reflected cross-site scripting via k304 parameter
- CVE-2026-27948 Copyparty vulnerable to eflected cross-site scripting via setck parameter
Sources
Also known as GHSA-5662-2rj7-f2v6, PYSEC-2026-1275.