# copyparty (PyPI) vulnerabilities Source: https://junglewise.ai/threats/technologies/copyparty Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/copyparty.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 15 vulnerabilities in copyparty (PyPI): 0 in the last 7 days and 2 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-104102, was published on 12 October 2026. 1 vulnerability in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 2 - All time: 15 (0 critical, 0 exploited in the wild) ## About copyparty (PyPI) A file server and gallery application for sharing files and folders. ## Latest copyparty (PyPI) vulnerabilities - [CVE-2026-104102: copyparty FTP path traversal in upload](https://junglewise.ai/threats/cve-2026-104102-copyparty-ftp-upload-outside-defined-volumes-limited-path) (medium, CVSS 4, published 12 Oct 2026) - [CVE-2026-70657: Copyparty file/dirkey confusion authorization bypass](https://junglewise.ai/threats/cve-2026-70657-copyparty-file-dirkey-confusion-authorization-bypass) (medium, CVSS 4.3, published 18 Aug 2026) - [CVE-2025-58753: PYSEC-2026-1279 - copyparty: Sharing a single file does not fully restrict access to other files in source folder](https://junglewise.ai/threats/cve-2025-58753-copyparty-sharing-a-single-file-does-not-fully-restrict-access-to) (medium, CVSS 4, published 7 Jul 2026) - [CVE-2025-54796: PYSEC-2026-1275 - copyparty allows Regex Denial of Service (ReDoS) in the upload listing](https://junglewise.ai/threats/cve-2025-54796-copyparty-allows-regex-denial-of-service-redos-in-the-upload) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2025-54589: PYSEC-2026-1276 - copyparty Reflected XSS via Filter Parameter](https://junglewise.ai/threats/cve-2025-54589-copyparty-reflected-xss-via-filter-parameter) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2025-54423: PYSEC-2026-1277 - copyparty has DOM-Based XSS vulnerability when displaying multimedia metadata](https://junglewise.ai/threats/cve-2025-54423-copyparty-has-dom-based-xss-vulnerability-when-displaying) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2025-27145: PYSEC-2026-1278 - copyparty renders unsanitized filenames as HTML when user uploads empty files](https://junglewise.ai/threats/cve-2025-27145-copyparty-renders-unsanitized-filenames-as-html-when-user-uploads) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2026-32109: Copyparty XSS via crafted URL to folder with .prologue.html](https://junglewise.ai/threats/cve-2026-32109-copyparty-xss-via-crafted-url-to-folder-with-prologue-html) (low, CVSS 3.7, published 12 Mar 2026) - [CVE-2026-32108: 9001 copyparty incorrect authorization in FTP and SFTP shares](https://junglewise.ai/threats/cve-2026-32108-9001-copyparty-incorrect-authorization-in-ftp-and-sftp-shares) (medium, CVSS 4, published 12 Mar 2026) - [CVE-2026-30974: copyparty: volflag `nohtml` did not block javascript in svg files](https://junglewise.ai/threats/cve-2026-30974-copyparty-volflag-nohtml-did-not-block-javascript-in-svg-files) (low, CVSS 3.1, published 10 Mar 2026) - [CVE-2026-27948: Copyparty vulnerable to reflected XSS via setck parameter](https://junglewise.ai/threats/cve-2026-27948-copyparty-vulnerable-to-reflected-xss-via-setck-parameter) (low, CVSS 3.1, published 26 Feb 2026) - [CVE-2023-41471: PYSEC-2025-240 - Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute…](https://junglewise.ai/threats/cve-2023-41471-pysec-2025-240-cross-site-scripting-vulnerability-in-copyparty) (low, CVSS 3.1, published 29 Aug 2025) - [CVE-2023-38501: copyparty vulnerable to reflected cross-site scripting via k304 parameter](https://junglewise.ai/threats/cve-2023-38501-copyparty-vulnerable-to-reflected-cross-site-scripting-via-k304) (low, CVSS 3.1, published 25 Jul 2023) - [copyparty vulnerable to reflected cross-site scripting via hc parameter](https://junglewise.ai/threats/copyparty-vulnerable-to-reflected-cross-site-scripting-via-hc-parameter-fe93d5b6) (low, CVSS 3.1, published 21 Jul 2023) - [CVE-2023-37474: PYSEC-2023-127 - Copyparty is a portable file server. Versions prior to 1.8.2 are subject to a path traversal…](https://junglewise.ai/threats/cve-2023-37474-copyparty-vulnerable-to-path-traversal-attack) (low, CVSS 3, published 14 Jul 2023) ## Most severe copyparty (PyPI) vulnerabilities - [CVE-2026-70657: Copyparty file/dirkey confusion authorization bypass](https://junglewise.ai/threats/cve-2026-70657-copyparty-file-dirkey-confusion-authorization-bypass) (medium, CVSS 4.3, published 18 Aug 2026) - [CVE-2025-58753: PYSEC-2026-1279 - copyparty: Sharing a single file does not fully restrict access to other files in source folder](https://junglewise.ai/threats/cve-2025-58753-copyparty-sharing-a-single-file-does-not-fully-restrict-access-to) (medium, CVSS 4, published 7 Jul 2026) - [CVE-2026-32108: 9001 copyparty incorrect authorization in FTP and SFTP shares](https://junglewise.ai/threats/cve-2026-32108-9001-copyparty-incorrect-authorization-in-ftp-and-sftp-shares) (medium, CVSS 4, published 12 Mar 2026) - [CVE-2026-104102: copyparty FTP path traversal in upload](https://junglewise.ai/threats/cve-2026-104102-copyparty-ftp-upload-outside-defined-volumes-limited-path) (medium, CVSS 4, published 12 Oct 2026) - [CVE-2026-32109: Copyparty XSS via crafted URL to folder with .prologue.html](https://junglewise.ai/threats/cve-2026-32109-copyparty-xss-via-crafted-url-to-folder-with-prologue-html) (low, CVSS 3.7, published 12 Mar 2026) - [CVE-2023-38501: copyparty vulnerable to reflected cross-site scripting via k304 parameter](https://junglewise.ai/threats/cve-2023-38501-copyparty-vulnerable-to-reflected-cross-site-scripting-via-k304) (low, CVSS 3.1, published 25 Jul 2023) - [CVE-2025-54589: PYSEC-2026-1276 - copyparty Reflected XSS via Filter Parameter](https://junglewise.ai/threats/cve-2025-54589-copyparty-reflected-xss-via-filter-parameter) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2025-27145: PYSEC-2026-1278 - copyparty renders unsanitized filenames as HTML when user uploads empty files](https://junglewise.ai/threats/cve-2025-27145-copyparty-renders-unsanitized-filenames-as-html-when-user-uploads) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2025-54796: PYSEC-2026-1275 - copyparty allows Regex Denial of Service (ReDoS) in the upload listing](https://junglewise.ai/threats/cve-2025-54796-copyparty-allows-regex-denial-of-service-redos-in-the-upload) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2025-54423: PYSEC-2026-1277 - copyparty has DOM-Based XSS vulnerability when displaying multimedia metadata](https://junglewise.ai/threats/cve-2025-54423-copyparty-has-dom-based-xss-vulnerability-when-displaying) (low, CVSS 3.1, published 7 Jul 2026) ## Vulnerabilities per week 1 vulnerability in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 1 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 1 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other PyPI technologies - [tensorflow (PyPI)](https://junglewise.ai/threats/technologies/pypi-tensorflow): 435 vulnerabilities - [tensorflow-cpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-cpu): 430 vulnerabilities - [tensorflow-gpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-gpu): 427 vulnerabilities - [open-webui (PyPI)](https://junglewise.ai/threats/technologies/open-webui): 177 vulnerabilities - [Django (PyPI)](https://junglewise.ai/threats/technologies/django): 173 vulnerabilities - [apache-airflow (PyPI)](https://junglewise.ai/threats/technologies/apache-airflow): 159 vulnerabilities - [pillow (PyPI)](https://junglewise.ai/threats/technologies/pillow): 125 vulnerabilities - [praisonai (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonai): 120 vulnerabilities - [vllm (PyPI)](https://junglewise.ai/threats/technologies/pypi-vllm): 117 vulnerabilities - [plone (PyPI)](https://junglewise.ai/threats/technologies/pypi-plone): 101 vulnerabilities - [mlflow (PyPI)](https://junglewise.ai/threats/technologies/mlflow): 88 vulnerabilities - [picklescan (PyPI)](https://junglewise.ai/threats/technologies/picklescan): 86 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "copyparty (PyPI) vulnerabilities", https://junglewise.ai/threats/technologies/copyparty, 13 November 2026.