What’s Vulnerable › Vulnerabilities

CVE-2025-54796: Copyparty is vulnerable to Regex Denial of Service (ReDoS) attacks through "Recent Uploads" page

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-08-02 · updated 2026-06-17
• Weakness: CWE-400

Description

Copyparty is a portable file server. Versions prior to 1.18.9, the filter parameter for the "Recent Uploads" page allows arbitrary RegExes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks the server. This is fixed in version 1.18.9.

Affected products

• 9001 copyparty: before 1.18.9 — fixed in 1.18.9

How to fix

Upgrade to a fixed version: 9001 copyparty 1.18.9. Check the vendor advisory for mitigations.

References

• https://github.com/9001/copyparty/commit/09910ba80784c3980947d92f45db696398c0fd83
• https://github.com/9001/copyparty/releases/tag/v1.18.9
• https://github.com/9001/copyparty/security/advisories/GHSA-5662-2rj7-f2v6
• https://github.com/9001/copyparty/security/advisories/GHSA-5662-2rj7-f2v6

Get alerted when CVE-2025-54796 or the next vulnerability affects your stack