PT-2025-31523 · Copyparty · Copyparty

Ju0X · Published 2025-07-31 · Updated 2025-08-15 · CVE-2025-54589

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Copyparty versions 1.18.6 and below

Description Copyparty is a portable file server susceptible to a reflected Cross-Site Scripting (XSS) issue. When accessing the recent uploads page at /?ru, the application does not properly escape user-supplied input in the filter parameter, which is directly reflected into a <script> block. This allows attackers to inject malicious scripts. The issue affects both authenticated and unauthenticated users.

Recommendations Update to version 1.18.7 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

CVE-2025-54589

GHSA-8MX2-RJH8-Q3JQ

Affected Products

Copyparty

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54589.json · Exploit
• 🔥 https://exploit-db.com/exploits/52390 · Exploit
• https://github.com/9001/copyparty/security/advisories/GHSA-8mx2-rjh8-q3jq · Vendor Advisory
• https://github.com/9001/copyparty/commit/a8705e611d05eeb22be5d3d7d9ab5c020fe54c62 · Patch
• https://osv.dev/vulnerability/CVE-2025-54589 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8mx2-rjh8-q3jq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54589 · Security Note
• https://github.com/9001/copyparty · Note
• https://github.com/9001/copyparty/releases/tag/v1.18.7 · Note
• https://twitter.com/CVEnew/status/1950924253911769292 · Twitter Post
• https://twitter.com/byte_reaper/status/1951044997287215171 · Twitter Post
• https://twitter.com/pdnuclei_bot/status/1956325017165103209 · Twitter Post
• https://t.me/CVEtracker/28858 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1950945350971170979 · Twitter Post