CVE-2026-27948: Copyparty vulnerable to reflected XSS via setck parameter

February 26, 2026

An XSS allows for reflected cross-site scripting via URL-parameter ?setck=...

References

github.com/9001/copyparty
github.com/9001/copyparty/commit/31b2801fd041f803f4a3d5c12c7d7cb5419048bc
github.com/9001/copyparty/releases/tag/v1.20.9
github.com/9001/copyparty/security/advisories/GHSA-62cr-6wp5-q43h
github.com/advisories/GHSA-62cr-6wp5-q43h
nvd.nist.gov/vuln/detail/CVE-2026-27948

Code Behaviors & Features

Detect and mitigate CVE-2026-27948 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →