# copyparty (PyPI) vulnerabilities

14 known vulnerabilities (3 high, 8 medium, 3 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://pypi.org/project/copyparty/

## Advisories (14)

### [CVE-2026-104102](https://cve.now/CVE-2026-104102): copyparty FTP: upload outside defined volumes (limited path traversal)

- Severity: Medium 5.3
- Published: Oct 12, 2026
- Affected: fixed in 1.20.19.

### [CVE-2026-70657](https://cve.now/CVE-2026-70657): Copyparty: file/dirkey confusion

- Severity: Medium 4.3
- Published: Aug 18, 2026
- Affected: fixed in 1.20.17.

### [CVE-2026-32109](https://cve.now/CVE-2026-32109): Copyparty has unexpected JavaScript execution via crafted URL to folder with \`.prologue.html\`

- Severity: Low 3.7
- Published: Mar 11, 2026
- Affected: fixed in 1.20.12.

### [CVE-2026-32108](https://cve.now/CVE-2026-32108): Copyparty ftp/sftp: Sharing a single file did not fully restrict source-folder access

- Severity: Low 2.3
- Published: Mar 11, 2026
- Affected: fixed in 1.20.12.

### [CVE-2026-30974](https://cve.now/CVE-2026-30974): Copyparty volflag \`nohtml\` did not block javascript in svg files

- Severity: Medium 4.6
- Published: Mar 10, 2026
- Affected: fixed in 1.20.11.

### [CVE-2026-27948](https://cve.now/CVE-2026-27948): Copyparty vulnerable to eflected cross-site scripting via setck parameter

- Severity: Medium 5.4
- Published: Feb 26, 2026
- Affected: fixed in 1.20.9.

### [CVE-2025-58753](https://cve.now/CVE-2025-58753): copyparty: Sharing a single file does not fully restrict access to other files in source folder

- Severity: Medium 5.3
- Published: Sep 9, 2025
- Affected: fixed in 1.19.8.

### [CVE-2023-41471](https://cve.now/CVE-2023-41471): Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to…

- Severity: High 7.8
- Published: Aug 29, 2025
- Affected: through 1.9.1.

### [CVE-2025-54796](https://cve.now/CVE-2025-54796): Copyparty is vulnerable to Regex Denial of Service (ReDoS) attacks through "Recent Uploads" page

- Severity: High 7.5
- Published: Aug 1, 2025
- Affected: fixed in 1.18.9.

### [CVE-2025-54589](https://cve.now/CVE-2025-54589): copyparty Reflected XSS via Filter Parameter

- Severity: Medium 6.3
- Published: Jul 31, 2025
- Affected: fixed in 1.18.7.

### [CVE-2025-54423](https://cve.now/CVE-2025-54423): copyparty has a DOM-Based XSS vulnerability when displaying multimedia metadata

- Severity: Medium 5.4
- Published: Jul 28, 2025
- Affected: fixed in 1.18.5.

### [CVE-2025-27145](https://cve.now/CVE-2025-27145): copyparty renders unsanitized filenames as HTML when user uploads empty files

- Severity: Low 3.6
- Published: Feb 25, 2025
- Affected: fixed in 1.16.15.

### [CVE-2023-38501](https://cve.now/CVE-2023-38501): copyparty vulnerable to reflected cross-site scripting via k304 parameter

- Severity: Medium 6.3
- Published: Jul 25, 2023
- Affected: fixed in 1.8.7.

### [CVE-2023-37474](https://cve.now/CVE-2023-37474): Path traversal in copyparty

- Severity: High 7.5
- Published: Jul 14, 2023
- Affected: fixed in 1.8.2.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/pypi/copyparty
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.