CVE-2025-58753: medium-severity vulnerability in 9001 copyparty
copyparty: Sharing a single file does not fully restrict access to other files in source folder
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.4%
Copyparty is a portable file server. In versions prior to 1.19.8, there was a missing permission-check in the shares feature (the `shr` global-option). When a share was created for just one file inside a folder, it was possible to access the other files inside that folder by guessing the filenames. It was not possible to descend into subdirectories in this manner; only the sibling files were accessible. This issue did not affect filekeys or dirkeys. Version 1.19.8 fixes the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
9001 · copypartyRelated CVEs — 9001 copyparty
In the same product, most dangerous first.
CVE-2023-37474HIGHPath traversal in copypartyEPSS 44.9%CVE-2023-38501MEDIUMcopyparty vulnerable to reflected cross-site scripting via k304 parameterEPSS 9.2%CVE-2025-54589MEDIUMcopyparty Reflected XSS via Filter ParameterEPSS 2.4%CVE-2025-54796HIGHCopyparty is vulnerable to Regex Denial of Service (ReDoS) attacks through "Recent Uploads" pageEPSS 0.5%CVE-2025-54423MEDIUMcopyparty has a DOM-Based XSS vulnerability when displaying multimedia metadataEPSS 0.5%CVE-2025-27145LOWcopyparty renders unsanitized filenames as HTML when user uploads empty filesEPSS 0.5%