Description
Copyparty is a portable file server. In versions 1.18.6 and below, when accessing the recent uploads page at `/?ru`, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which reflects its value directly into a `<script>` block without proper escaping, allowing for reflected Cross-Site Scripting (XSS) and can be exploited against both authenticated and unauthenticated users. This is fixed in version 1.18.7.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| 9001 | copyparty | < 1.18.7 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Copyparty 1.18.6 - Reflected Cross-Site Scripting (XSS) EDB-52390 · webapps · Aug 3, 2025
GitHub 1 repository
-
byteReaper77/CVE-2025-54589 ★ 2 · Jul 31, 2025
PoC for CVE-2025-54589 – a reflected XSS vulnerability in Copyparty ≤ 1.18.6.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Copyparty <=1.18.6 - Cross-Site Scripting http/cves/2025/CVE-2025-54589.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | copyparty | < 1.18.7 | 1.18.7 | GHSA-8mx2-rjh8-q3jq |