Vulnerability PYSEC-2026-1275
High Risk
HIGH RISK
CVSS Score: 7.5
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
3 months ago
July 07, 2026 at 04:03 PM UTC
copyparty allows Regex Denial of Service (ReDoS) in the upload listing
0.2.3 - 1.18.8
0.2.3 - 1.18.8
Summary
copyparty allows Regex Denial of Service (ReDoS) in the upload listing
Details
Summary
The filter parameter for the "Recent uploads" page allows arbitrary Regexes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks the server.
PoC
https://127.0.0.1:3923/?ru&filter=(.+)+x
Impact
The server becomes fully inaccessible for a long time.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
6 hours ago
copyparty FTP: upload outside defined volumes (limited path traversal)
0.2.3 - 1.20.18 GHSA-phv8-wgjp-g4p9
0.2.3 - 1.20.18 GHSA-phv8-wgjp-g4p9
Medium Risk
1 month ago
Copyparty vulnerable to file/dirkey confusion
0.2.3 - 1.20.16 PYSEC-2026-3660
0.2.3 - 1.20.16 PYSEC-2026-3660
Medium Risk
1 month ago
Copyparty vulnerable to file/dirkey confusion
0.2.3 - 1.20.16 GHSA-x5pq-m9p8-f4vx
0.2.3 - 1.20.16 GHSA-x5pq-m9p8-f4vx
Unknown
3 months ago
copyparty: Sharing a single file does not fully restrict access to other files in source folder
0.2.3 - 1.19.7 PYSEC-2026-1279
0.2.3 - 1.19.7 PYSEC-2026-1279
Medium Risk
3 months ago
copyparty Reflected XSS via Filter Parameter
0.2.3 - 1.18.6 PYSEC-2026-1276
0.2.3 - 1.18.6 PYSEC-2026-1276
Impacted packages
Timeline
Published
3 months ago
July 07, 2026 at 04:03 PM UTC
Fixed (1.18.9)
1 year ago
August 01, 2025 at 09:19 PM UTC
Last Modified
3 months ago
July 07, 2026 at 05:47 PM UTC