- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 14 · 3 high, 8 medium, 3 low
- Registry
- PyPI
Advisories 14
- CVE-2026-104102Medium 5.3
copyparty FTP: upload outside defined volumes (limited path traversal)
Affected: fixed in 1.20.19.
- CVE-2026-70657Medium 4.3
Copyparty: file/dirkey confusion
Affected: fixed in 1.20.17.
- CVE-2026-32109Low 3.7
Copyparty has unexpected JavaScript execution via crafted URL to folder with `.prologue.html`
Affected: fixed in 1.20.12.
- CVE-2026-32108Low 2.3
Copyparty ftp/sftp: Sharing a single file did not fully restrict source-folder access
Affected: fixed in 1.20.12.
- CVE-2026-30974Medium 4.6
Copyparty volflag `nohtml` did not block javascript in svg files
Affected: fixed in 1.20.11.
- CVE-2026-27948Medium 5.4
Copyparty vulnerable to eflected cross-site scripting via setck parameter
Affected: fixed in 1.20.9.
- CVE-2025-58753Medium 5.3
copyparty: Sharing a single file does not fully restrict access to other files in source folder
Affected: fixed in 1.19.8.
- CVE-2023-41471High 7.8
Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to…
Affected: through 1.9.1.
- CVE-2025-54796High 7.5
Copyparty is vulnerable to Regex Denial of Service (ReDoS) attacks through "Recent Uploads" page
Affected: fixed in 1.18.9.
- CVE-2025-54589Medium 6.3
copyparty Reflected XSS via Filter Parameter
Affected: fixed in 1.18.7.
- CVE-2025-54423Medium 5.4
copyparty has a DOM-Based XSS vulnerability when displaying multimedia metadata
Affected: fixed in 1.18.5.
- CVE-2025-27145Low 3.6
copyparty renders unsanitized filenames as HTML when user uploads empty files
Affected: fixed in 1.16.15.
- CVE-2023-38501Medium 6.3
copyparty vulnerable to reflected cross-site scripting via k304 parameter
Affected: fixed in 1.8.7.
- CVE-2023-37474High 7.5
Path traversal in copyparty
Affected: fixed in 1.8.2.