Back to Database
Status published
Medium
CVE-2025-54423
copyparty has a DOM-Based XSS vulnerability when displaying multimedia metadata
Vulnerability Description
copyparty is a portable file server. In versions up to and including versions 1.18.4, an unauthenticated attacker is able to execute arbitrary JavaScript code in a victim's browser due to improper sanitization of multimedia tags in music files, including m3u files. This is fixed in version 1.18.5.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-54423
Credits & Attribution
No credits recorded in the NVD database.
References
More from 9001
View All →CVE-2025-58753
copyparty: Sharing a single file does not fully restrict access to other files in source folder
Medium
5.3
CVE-2025-54796
Copyparty is vulnerable to Regex Denial of Service (ReDoS) attacks through "Recent Uploads" page
High
7.5
CVE-2025-54589
copyparty Reflected XSS via Filter Parameter
Medium
6.3
CVE-2025-27145
copyparty renders unsanitized filenames as HTML when user uploads empty files
Low
3.6
CVE-2023-38501
copyparty vulnerable to reflected cross-site scripting via k304 parameter
Medium
6.3
Affected Vendor
9001
View all reports →Affected Software
copyparty
Vulnerable Versions:
< 1.18.5
Timeline
Official Publish:
July 28th, 2025
Last Modified:
July 28th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N