CVE-2025-54796
HIGHcopyparty < 1.18.9 - Denial of Service via Filter Parameter Regular Expression
Title source: llmDescription
Copyparty is a portable file server. Versions prior to 1.18.9, the filter parameter for the "Recent Uploads" page allows arbitrary RegExes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks the server. This is fixed in version 1.18.9.
References (3)
Core 3
Core References
Exploit, Vendor Advisory x_refsource_confirm
https://github.com/9001/copyparty/security/advisories/GHSA-5662-2rj7-f2v6
Patch x_refsource_misc
https://github.com/9001/copyparty/commit/09910ba80784c3980947d92f45db696398c0fd83
Release Notes x_refsource_misc
https://github.com/9001/copyparty/releases/tag/v1.18.9
Scores
CVSS v3
7.5
EPSS
0.0038
EPSS Percentile
29.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-1333
CWE-400
CWE-833
Status
published
Products (2)
9001/copyparty
< 1.18.9
pypi/copyparty
0 - 1.18.9PyPI
Published
Aug 02, 2025
Tracked Since
Feb 18, 2026