CVE-2023-38501mediumCWE-79

CVE-2023-38501: medium-severity vulnerability in 9001 copyparty

copyparty vulnerable to reflected cross-site scripting via k304 parameter

Published · Updated

Follow this CVE+ Monitor copyparty+ Monitor copyparty

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

48Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 6.3epss 9.2%
from disclosure to weapon3 days
Published on NVDJul 25
1st PoC+3d
copyparty is file server software. Prior to version 1.8.7, the application contains a reflected cross-site scripting via URL-parameter `?k304=...` and `?setck=...`. The worst-case outcome of this is being able to move or delete existing files on the server, or upload new files, using the account of the person who clicks the malicious link. It is recommended to change the passwords of one's copyparty accounts, unless one have inspected one's logs and found no trace of attacks. Version 1.8.7 contains a patch for the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Affected products
9001 · copyparty
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — 9001 copyparty

In the same product, most dangerous first.

CVE-2023-37474HIGHPath traversal in copypartyEPSS 44.9%CVE-2025-54589MEDIUMcopyparty Reflected XSS via Filter ParameterEPSS 2.4%CVE-2025-54796HIGHCopyparty is vulnerable to Regex Denial of Service (ReDoS) attacks through "Recent Uploads" pageEPSS 0.5%CVE-2025-54423MEDIUMcopyparty has a DOM-Based XSS vulnerability when displaying multimedia metadataEPSS 0.5%CVE-2025-27145LOWcopyparty renders unsanitized filenames as HTML when user uploads empty filesEPSS 0.5%CVE-2026-30974MEDIUMCopyparty volflag `nohtml` did not block javascript in svg filesEPSS 0.4%