CVE-2025-54423: 9001 Copyparty XSS Vulnerability

CVE-2025-54423 Overview

CVE-2025-54423 is a stored Cross-Site Scripting (XSS) vulnerability in copyparty, a portable file server developed by 9001. The flaw affects all versions up to and including 1.18.4. An unauthenticated attacker can execute arbitrary JavaScript in a victim's browser through improper sanitization of multimedia tags in music files, including .m3u playlist files. The issue is tracked under [CWE-79] and was fixed in version 1.18.5.

Critical Impact
Unauthenticated attackers can inject malicious scripts via crafted media file metadata, executing arbitrary JavaScript in the browsers of users who visit the copyparty directory listing.

Affected Products

copyparty versions up to and including 1.18.4
Vendor: 9001 (upstream maintainer)
Fixed in copyparty 1.18.5

Discovery Timeline

2025-07-28 - CVE-2025-54423 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54423

Vulnerability Analysis

The vulnerability resides in copyparty's browser-facing directory listing component. When copyparty indexes uploaded music files, it extracts multimedia tags such as artist, album, and title metadata. These tag values, along with entries from .m3u playlist files, are rendered into the HTML directory view without proper output encoding. An attacker can craft a music file or playlist containing HTML or JavaScript payloads within its tag fields. When a victim browses to the directory hosting the malicious file, the payload executes in the victim's browser under the origin of the copyparty server.

Because copyparty allows unauthenticated uploads in many deployments, exploitation requires no credentials. The scoped impact extends beyond the vulnerable component due to browser same-origin context, aligning with the changed scope classification.

Root Cause

The root cause is missing HTML escaping of tag keys iterated in the browser.js client-side rendering logic. Tag names sourced from parsed media files were interpolated directly into the DOM. The patch in commit 895880a wraps the tag key with the existing esc() escaping helper before use.

Attack Vector

An attacker uploads a music file or .m3u playlist containing malicious script content within a metadata tag. When any user, including administrators, opens the containing directory in the copyparty web interface, the browser parses the injected markup and executes attacker-controlled JavaScript. This enables session token theft, CSRF-style actions against the copyparty instance, or delivery of further payloads.

javascript

// Patch from copyparty/web/browser.js - fix GHSA-9q4r-x2hj-jmvr
				nodes = ['<tr><td>-</td><td><div>' + links + '</div>', sz];
 
 			for (var b = 0; b < tagord.length; b++) {
-				var k = tagord[b],
+				var k = esc(tagord[b]),
 					v = r.tags[k] || "";
 
 				if (k == ".dur") {

Source: GitHub commit 895880a. The fix applies the esc() sanitization helper to the tag key before it is inserted into the rendered node.

Detection Methods for CVE-2025-54423

Indicators of Compromise

Media files (.mp3, .flac, .m3u, and similar) containing HTML tags such as <script>, <img onerror=...>, or javascript: URIs within ID3, Vorbis, or playlist metadata fields.
Copyparty access logs showing uploads of media files followed by directory listing requests from other authenticated users or administrators.
Outbound browser requests from copyparty users to unfamiliar external hosts shortly after visiting shared directories.

Detection Strategies

Scan uploaded media content and .m3u playlists for HTML control characters (<, >, quotes) or on*= event handler substrings within tag fields.
Deploy Content Security Policy (CSP) reporting to capture inline-script violations originating from the copyparty origin.
Review copyparty server logs for anonymous uploads correlated with subsequent XSS callbacks in web proxy or DNS telemetry.

Monitoring Recommendations

Alert on any copyparty instance running a version earlier than 1.18.5 reachable from untrusted networks.
Monitor browser telemetry from endpoints that access internal file-sharing services for unexpected script execution or credential prompts.
Track file uploads to copyparty directories writable by anonymous or low-privilege users.

How to Mitigate CVE-2025-54423

Immediate Actions Required

Upgrade copyparty to version 1.18.5 or later, which contains the fix from commit 895880a.
Restrict anonymous upload permissions on any copyparty instance that cannot be immediately patched.
Audit existing shared directories for previously uploaded media files with suspicious metadata and remove or quarantine them.

Patch Information

The fix is available in copyparty release v1.18.5 and documented in GitHub Security Advisory GHSA-9q4r-x2hj-jmvr. The upstream commit applying the sanitization change is 895880a.

Workarounds

Disable anonymous or untrusted uploads on affected copyparty deployments until patching is complete.
Place copyparty behind an authenticating reverse proxy to limit exposure to unauthenticated attackers.
Enforce a strict Content Security Policy that blocks inline scripts served from the copyparty origin.

bash

# Upgrade copyparty to the patched release
pip install --upgrade copyparty>=1.18.5

# Verify the installed version
copyparty --version