CVE-2025-54589
MEDIUM NUCLEIcopyparty < 1.18.7 - Reflected Cross-Site Scripting via Recent Uploads Filter Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2025-54589. PoCs published by Byte Reaper, byteReaper77. A Nuclei detection template is also available.
AI-analyzed exploit summary This is a functional proof-of-concept exploit for CVE-2025-54589, a reflected XSS vulnerability in Copyparty ≤ 1.18.6. It demonstrates the injection of arbitrary JavaScript via the 'filter' parameter by sending crafted HTTP requests and checking responses for XSS indicators.
Description
Copyparty is a portable file server. In versions 1.18.6 and below, when accessing the recent uploads page at `/?ru`, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which reflects its value directly into a `<script>` block without proper escaping, allowing for reflected Cross-Site Scripting (XSS) and can be exploited against both authenticated and unauthenticated users. This is fixed in version 1.18.7.
Exploits (2)
This is a functional proof-of-concept exploit for CVE-2025-54589, a reflected XSS vulnerability in Copyparty ≤ 1.18.6. It demonstrates the injection of arbitrary JavaScript via the 'filter' parameter by sending crafted HTTP requests and checking responses for XSS indicators.
This repository contains a functional exploit for CVE-2025-54589, a reflected XSS vulnerability in Copyparty ≤ 1.18.6. The exploit automates the injection of crafted JavaScript payloads into the 'filter' parameter and checks for successful reflection.
Nuclei Templates (1)
http.title:"copyparty"
title="copyparty"
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L