CVE-2025-54589

Katalog CVE

CVSS 6.1 · Medium EPSS 2,4%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada 9001 copyparty. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Copyparty is a portable file server. In versions 1.18.6 and below, when accessing the recent uploads page at `/?ru`, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which reflects its value directly into a `<script>` block without proper escaping, allowing for reflected Cross-Site Scripting (XSS) and can be exploited against both authenticated and unauthenticated users. This is fixed in version 1.18.7.

Rincian

Terbit di NVD

31 Juli 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

EPSS (30 hari)

2,4% peluang dieksploitasi; lebih tinggi dari 83,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/9001/copyparty/security/advisories/GHSA-8mx2-rjh8-q3jq exploit · advisory vendor
• https://github.com/9001/copyparty/commit/a8705e611d05eeb22be5d3d7d9ab5c020fe54c62 patch
• https://github.com/9001/copyparty/releases/tag/v1.18.7 release notes