The FTP and FTPS server – if enabled – would allow uploading to any folder that the copyparty process had permission to write to. The FTP-server is default-disabled, and must be explicitly enabled in the config with global-option ftp or ftps to be affected. Additionally, SFTP was not affected at all; only FTP and FTPS. This was not a full read/write path-traversal; it had the following limitations: Only applied to …
A valid filekey could potentially be converted into a dirkey, granting read-access to the containing folder. This issue only affected volumes which simultaneously enable both filekeys and dirkeys, with volflag dk or dks combined with fk or fka. Both required features are default-disabled, and must be explicitly enabled in the volflags (the "flags" section of a volume).
If an attacker has been given both read- and write-permissions to the server, they can upload a malicious file with the filename .prologue.html and then craft a link to potentially execute arbitrary JavaScript in the victim's context. Note that it is intended behavior that the JavaScript would execute if the target clicks a link to the HTML file itself; "https://example.com/foo/.prologue.html". The vulnerability is that "https://example.com/foo/?b" would also evaluate the file, …
There was a missing permission-check in the shares feature (the shr global-option). This vulnerability only applies in the following scenario: The shares feature is used for the specific purpose of creating a share of just a single file inside a folder Either the FTP or SFTP server is enabled, and also made publically accessible If a share is password-protected, then SFTP was not vulnerable unless the sftp-pw global-option was also …
The nohtml config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG images.
An XSS allows for reflected cross-site scripting via URL-parameter ?setck=…
There was a missing permission-check in the shares feature (the shr global-option). When a share is created for just one file inside a folder, it was possible to access the other files inside that folder by guessing the filenames. It was not possible to descend into subdirectories in this manner; only the sibling files were accessible. This issue did not affect filekeys or dirkeys.
The filter parameter for the "Recent uploads" page allows arbitrary Regexes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks the server.
Unauthorized reflected Cross-Site-Scripting when accessing the URL for recent uploads with the filter parameter containing JavaScript code.
This advisory duplicates another.
An unauthenticated attacker is able to execute arbitrary JavaScript code in a victim's browser due to improper sanitization of multimedia tags in music files, including m3u files.
A DOM-Based XSS was discovered in copyparty, a portable fileserver. The vulnerability is considered low-risk.
The application contains a reflected cross-site scripting via URL-parameter ?k304=… and ?setck=…
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in copyparty.
All versions before 1.8.2 have a path traversal vulnerability, allowing an attacker to download unintended files from the server.