Executive brief
Copyparty is a portable file server. In versions prior to 1.20.9, an XSS allows for reflected cross-site scripting via URL-parameter `?setck=...`. Version 1.20.9 fixes the issue.
Affected products
- PyPI copyparty
Junglewise Threat Intelligence
CVE-2026-27948: PYSEC-2026-2136 - Copyparty is a portable file server. In versions prior to 1.20.9, an XSS allows for reflected cross-site scripting via URL-parameter `?setck
CVE-2026-27948 · Severity: low · CVSS 3.1 · Published 2026-02-26
Technologies: copyparty (PyPI). Vendors: PyPI.
Related threats
- Copyparty file/dirkey confusion authorization bypass
- PYSEC-2026-1279 - copyparty: Sharing a single file does not fully restrict access to other files in source folder
- PYSEC-2026-1275 - copyparty allows Regex Denial of Service (ReDoS) in the upload listing
- PYSEC-2026-1276 - copyparty Reflected XSS via Filter Parameter
- PYSEC-2026-1277 - copyparty has DOM-Based XSS vulnerability when displaying multimedia metadata