Back to Database
Status published
High
CVE-2025-54796
Copyparty is vulnerable to Regex Denial of Service (ReDoS) attacks through "Recent Uploads" page
Vulnerability Description
Copyparty is a portable file server. Versions prior to 1.18.9, the filter parameter for the "Recent Uploads" page allows arbitrary RegExes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks the server. This is fixed in version 1.18.9.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-54796
Credits & Attribution
No credits recorded in the NVD database.
References
More from 9001
View All →CVE-2025-58753
copyparty: Sharing a single file does not fully restrict access to other files in source folder
Medium
5.3
CVE-2025-54589
copyparty Reflected XSS via Filter Parameter
Medium
6.3
CVE-2025-54423
copyparty has a DOM-Based XSS vulnerability when displaying multimedia metadata
Medium
5.4
CVE-2025-27145
copyparty renders unsanitized filenames as HTML when user uploads empty files
Low
3.6
CVE-2023-38501
copyparty vulnerable to reflected cross-site scripting via k304 parameter
Medium
6.3
Affected Vendor
9001
View all reports →Affected Software
copyparty
Vulnerable Versions:
< 1.18.9
Timeline
Official Publish:
August 1st, 2025
Last Modified:
August 4th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H