9001 copyparty up to 1.16.14 Web UI cross site scripting

Summaryinfo

A vulnerability was found in 9001 copyparty up to 1.16.14. It has been declared as problematic. This affects an unknown function of the component Web UI. Executing a manipulation can lead to cross site scripting. This vulnerability is tracked as CVE-2025-27145. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in 9001 copyparty up to 1.16.14. This vulnerability affects some unknown processing of the component Web UI. The manipulation with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-83. The product does not neutralize or incorrectly neutralizes "javascript:" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style. As an impact it is known to affect integrity. CVE summarizes:

copyparty, a portable file server, has a DOM-based cross-site scripting vulnerability in versions prior to 1.16.15. The vulnerability is considered low-risk. By handing someone a maliciously-named file, and then tricking them into dragging the file into copyparty's Web-UI, an attacker could execute arbitrary javascript with the same privileges as that user. For example, this could give unintended read-access to files owned by that user. The bug is triggered by the drag-drop action itself; it is not necessary to actually initiate the upload. The file must be empty (zero bytes). Note that, as a general-purpose webserver, it is intentionally possible to upload HTML-files with arbitrary javascript in `` tags, which will execute when the file is opened. The difference is that this vulnerability would trigger execution of javascript during the act of uploading, and not when the uploaded file was opened. Version 1.16.15 contains a fix.

The advisory is available at github.com. This vulnerability was named CVE-2025-27145 since 02/19/2025. The exploitation appears to be difficult. The attack can be initiated remotely. Successful exploitation requires user interaction by the victim. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1059.007 by the MITRE ATT&CK project.

Upgrading to version 1.16.15 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 438ea6ccb06f39d7cbb4b6ee7ad44606e21a63dd is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• 9001

Name

• copyparty

Version

• 1.16.0
• 1.16.1
• 1.16.2
• 1.16.3
• 1.16.4
• 1.16.5
• 1.16.6
• 1.16.7
• 1.16.8
• 1.16.9
• 1.16.10
• 1.16.11
• 1.16.12
• 1.16.13
• 1.16.14

License

• open-source

Website

• Product: https://github.com/9001/copyparty/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion