CVE-2025-54796: falha de alta gravidade em 9001 copyparty
Copyparty is vulnerable to Regex Denial of Service (ReDoS) attacks through "Recent Uploads" page
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 0.5%
Copyparty is a portable file server. Versions prior to 1.18.9, the filter parameter for the "Recent Uploads" page allows arbitrary RegExes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks the server. This is fixed in version 1.18.9.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
9001 · copypartyCVEs relacionadas — 9001 copyparty
No mesmo produto, das mais perigosas para as menos.
CVE-2023-37474HIGHPath traversal in copypartyEPSS 44.9%CVE-2023-38501MEDIUMcopyparty vulnerable to reflected cross-site scripting via k304 parameterEPSS 9.2%CVE-2025-54589MEDIUMcopyparty Reflected XSS via Filter ParameterEPSS 2.4%CVE-2025-54423MEDIUMcopyparty has a DOM-Based XSS vulnerability when displaying multimedia metadataEPSS 0.5%CVE-2025-27145LOWcopyparty renders unsanitized filenames as HTML when user uploads empty filesEPSS 0.5%CVE-2026-30974MEDIUMCopyparty volflag `nohtml` did not block javascript in svg filesEPSS 0.4%