Executive brief
copyparty renders unsanitized filenames as HTML when user uploads empty files
Affected products
- PyPI copyparty
Junglewise Threat Intelligence
CVE-2025-27145: PYSEC-2026-1278 - copyparty renders unsanitized filenames as HTML when user uploads empty files
CVE-2025-27145 · Severity: low · CVSS 3.1 · Published 2026-07-07
Technologies: copyparty (PyPI). Vendors: PyPI.
Related threats
- Copyparty file/dirkey confusion authorization bypass
- PYSEC-2026-1279 - copyparty: Sharing a single file does not fully restrict access to other files in source folder
- PYSEC-2026-1275 - copyparty allows Regex Denial of Service (ReDoS) in the upload listing
- PYSEC-2026-1276 - copyparty Reflected XSS via Filter Parameter
- PYSEC-2026-1277 - copyparty has DOM-Based XSS vulnerability when displaying multimedia metadata