9001/copyparty Security Advisories | GitStock

medium2026-10-15

copyparty FTP: upload outside defined volumes (limited path traversal)

GHSA-phv8-wgjp-g4p9 · CVE-2026-104102

medium2026-08-18

Copyparty vulnerable to file/dirkey confusion

GHSA-x5pq-m9p8-f4vx · CVE-2026-70657

low2026-03-12

Copyparty has unexpected JavaScript execution via crafted URL to folder with `.prologue.html`

GHSA-rcp6-88mm-9vgf · CVE-2026-32109

low2026-03-12

Copyparty ftp/sftp: Sharing a single file did not fully restrict source-folder access

GHSA-67rw-2x62-mqqm · CVE-2026-32108

medium2026-03-10

copyparty: volflag `nohtml` did not block javascript in svg files

GHSA-m6hv-x64c-27mm · CVE-2026-30974

medium2026-02-26

Copyparty vulnerable to reflected XSS via setck parameter

GHSA-62cr-6wp5-q43h · CVE-2026-27948

medium2025-09-09

copyparty: Sharing a single file does not fully restrict access to other files in source folder

GHSA-pxvw-4w88-6x95 · CVE-2025-58753

high2025-08-04

copyparty allows Regex Denial of Service (ReDoS) in the upload listing

GHSA-5662-2rj7-f2v6 · CVE-2025-54796

medium2025-07-31

copyparty Reflected XSS via Filter Parameter

GHSA-8mx2-rjh8-q3jq · CVE-2025-54589

medium2025-07-28

copyparty has DOM-Based XSS vulnerability when displaying multimedia metadata

GHSA-9q4r-x2hj-jmvr · CVE-2025-54423

low2025-02-26

copyparty renders unsanitized filenames as HTML when user uploads empty files

GHSA-m2jw-cj8v-937r · CVE-2025-27145

medium2023-07-25

copyparty vulnerable to reflected cross-site scripting via k304 parameter

GHSA-f54q-j679-p9hh · CVE-2023-38501

medium2023-07-21

copyparty vulnerable to reflected cross-site scripting via hc parameter

GHSA-cw7j-v52w-fp5r

high2023-07-14

copyparty vulnerable to path traversal attack

GHSA-pxfv-7rr3-2qjg · CVE-2023-37474