CVE-2025-54589: 9001 Copyparty XSS Vulnerability

CVE-2025-54589 Overview

CVE-2025-54589 is a reflected Cross-Site Scripting (XSS) vulnerability in Copyparty, a portable file server maintained by the 9001 project. The flaw affects versions 1.18.6 and below. When users access the recent uploads page at /?ru, the filter parameter is reflected directly into a <script> block without proper escaping. Attackers can craft malicious URLs that execute arbitrary JavaScript in the victim's browser. The vulnerability affects both authenticated and unauthenticated users. The issue is tracked under advisory GHSA-8mx2-rjh8-q3jq and resolved in version 1.18.7.

Critical Impact
Attackers can hijack sessions, steal credentials, and perform actions on behalf of Copyparty users by tricking them into clicking a crafted URL.

Affected Products

Copyparty versions 1.18.6 and below
Vendor: 9001 (Copyparty project)
Fixed in: Copyparty version 1.18.7

Discovery Timeline

2025-07-31 - CVE-2025-54589 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54589

Vulnerability Analysis

The vulnerability is a reflected Cross-Site Scripting flaw classified under [CWE-79]. The recent uploads page (/?ru) accepts a filter parameter from user input via a search field at the top of the interface. Copyparty embeds this value directly into an inline JavaScript <script> block rendered in the HTTP response. Because the parameter is not properly encoded for a JavaScript string context, attackers can break out of the string literal and inject arbitrary code.

Root Cause

The root cause is missing context-aware output encoding. The existing html_escape function only handled HTML entity escaping, which is insufficient inside a <script> block where JavaScript syntax controls execution. Without escaping characters like <, >, and & into their Unicode-escaped equivalents, attacker-controlled input becomes executable script content when the page loads.

Attack Vector

Exploitation requires user interaction. An attacker crafts a URL containing malicious JavaScript in the filter parameter and delivers it via phishing, chat, or another social engineering channel. When a victim visits the link, the payload executes in their browser under Copyparty's origin. The attack succeeds against unauthenticated users as well, expanding the exposed user base.

python

# Fix in copyparty/util.py - introduces json_hesc for safe embedding in <script> blocks
def json_hesc(s: str) -> str:
    return s.replace("<", "\\\u003c").replace(">", "\\\u003e").replace("&", "\\\u0026")


def html_escape(s: str, quot: bool = False, crlf: bool = False) -> str:
    """html.escape but also newlines"""
    s = s.replace("&", "&").replace("<", "<").replace(">", ">")

Source: GitHub Commit a8705e6

The patch introduces json_hesc, which escapes <, >, and & as Unicode escape sequences (\\u003c, \\u003e, \\u0026). This prevents attacker input from terminating the surrounding <script> block or introducing new tags.

Detection Methods for CVE-2025-54589

Indicators of Compromise

HTTP requests to /?ru containing suspicious characters in the filter parameter, such as <, >, ", or JavaScript keywords like alert, document.cookie, or fetch.
Referer headers on outbound traffic pointing back to a Copyparty instance with URL-encoded script payloads.
Unexpected outbound requests from user browsers to attacker-controlled domains shortly after visiting a Copyparty link.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect query strings on the /?ru endpoint for reflected XSS payloads.
Review Copyparty access logs for GET requests to /?ru containing URL-encoded angle brackets or script tags.
Correlate browser-side content security policy (CSP) violation reports with Copyparty page loads.

Monitoring Recommendations

Enable verbose HTTP logging on Copyparty and forward logs to a centralized SIEM for pattern analysis.
Monitor for phishing campaigns referencing internal Copyparty URLs with unusual query parameters.
Track user agent activity for anomalous JavaScript execution or credential submission events tied to Copyparty sessions.

How to Mitigate CVE-2025-54589

Immediate Actions Required

Upgrade Copyparty to version 1.18.7 or later without delay, which contains the json_hesc output encoding fix.
Audit exposed Copyparty deployments and restrict public internet access where feasible.
Rotate credentials for accounts that may have interacted with untrusted Copyparty links during the vulnerable window.

Patch Information

The fix is available in Copyparty version 1.18.7. See the GitHub Release v1.18.7 and the GitHub Security Advisory GHSA-8mx2-rjh8-q3jq for full details. The patch commit a8705e6 adds the json_hesc helper to safely escape values reflected inside <script> blocks.

Workarounds

Place Copyparty behind a reverse proxy that filters query parameters on /?ru for XSS payloads if immediate patching is not possible.
Enforce a strict Content Security Policy that disallows inline script execution to reduce reflected XSS impact.
Restrict access to Copyparty using network-level controls, VPN, or authentication proxies until upgrading.

bash

# Upgrade Copyparty to the patched release
pip install --upgrade copyparty==1.18.7

# Verify installed version
copyparty --version