9001 copyparty vulnerabilities

15 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 13 published in the last 12 months.

Latest 9001 copyparty vulnerabilities

CVE-2026-104102 — copyparty FTP: upload outside defined volumes (limited path traversal) (CVSS 5.3)
CVE-2026-93353 — copyparty SFTP Volume Restriction Bypass via mkdir/rmdir/chattr Handlers (CVSS 3.1)
CVE-2026-70657 — Copyparty: file/dirkey confusion (CVSS 4.3)
CVE-2026-32109 — Copyparty has unexpected JavaScript execution via crafted URL to folder with `.prologue.html` (CVSS 4.4)
CVE-2026-32108 — Copyparty ftp/sftp: Sharing a single file did not fully restrict source-folder access (CVSS 6.5)
CVE-2026-30974 — Copyparty volflag `nohtml` did not block javascript in svg files (CVSS 5.4)
CVE-2026-27948 — Copyparty vulnerable to eflected cross-site scripting via setck parameter (CVSS 6.1)
CVE-2025-58753 — copyparty: Sharing a single file does not fully restrict access to other files in source folder (CVSS 7.5)
CVE-2023-41471 — (CVSS 7.8)
CVE-2025-54796 — Copyparty is vulnerable to Regex Denial of Service (ReDoS) attacks through "Recent Uploads" page (CVSS 7.5)
CVE-2025-54589 — copyparty Reflected XSS via Filter Parameter (CVSS 6.1)
CVE-2025-54423 — copyparty has a DOM-Based XSS vulnerability when displaying multimedia metadata (CVSS 6.1)
CVE-2025-27145 — copyparty renders unsanitized filenames as HTML when user uploads empty files (CVSS 6.1)
CVE-2023-38501 — copyparty vulnerable to reflected cross-site scripting via k304 parameter (CVSS 6.1)
CVE-2023-37474 — Path traversal in copyparty (CVSS 7.5)