CVE-2025-27145: copyparty renders unsanitized filenames as HTML when user uploads empty files

February 26, 2025

A DOM-Based XSS was discovered in copyparty, a portable fileserver. The vulnerability is considered low-risk.

References

github.com/9001/copyparty
github.com/9001/copyparty/commit/438ea6ccb06f39d7cbb4b6ee7ad44606e21a63dd
github.com/9001/copyparty/releases/tag/v1.16.15
github.com/9001/copyparty/security/advisories/GHSA-m2jw-cj8v-937r
github.com/advisories/GHSA-m2jw-cj8v-937r
nvd.nist.gov/vuln/detail/CVE-2025-27145

Code Behaviors & Features

Detect and mitigate CVE-2025-27145 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →