https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-30974.htmlhttps://patchthecve.com/cve/CVE-2026-30974.htmlWed, 17 Jun 2026 10:33:15 +0000MEDIUM 4.6: Copyparty is a portable file server. Prior to v1.20.11., the nohtml config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG images. A user with write-permission could upload an SVG containing embedded JavaScript, which would execute in the contexthttps://patchthecve.com/cve/CVE-2026-27948.htmlhttps://patchthecve.com/cve/CVE-2026-27948.htmlWed, 17 Jun 2026 10:27:57 +0000MEDIUM 5.4: Copyparty is a portable file server. In versions prior to 1.20.9, an XSS allows for reflected cross-site scripting via URL-parameter `?setck=...`. Version 1.20.9 fixes the issue.https://patchthecve.com/cve/CVE-2025-58753.htmlhttps://patchthecve.com/cve/CVE-2025-58753.htmlWed, 17 Jun 2026 09:44:52 +0000HIGH 7.5: Copyparty is a portable file server. In versions prior to 1.19.8, there was a missing permission-check in the shares feature (the `shr` global-option). When a share was created for just one file inside a folder, it was possible to access the other files inside that folder by guessing the filenames. https://patchthecve.com/cve/CVE-2023-41471.htmlhttps://patchthecve.com/cve/CVE-2023-41471.htmlWed, 17 Jun 2026 06:22:10 +0000HIGH 7.8: Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to the WEEKEND-PLANS function. NOTE: this is disputed because WEEKEND-PLANS is accessible only to actors who already have write access to the server, and they can morehttps://patchthecve.com/cve/CVE-2025-54796.htmlhttps://patchthecve.com/cve/CVE-2025-54796.htmlWed, 17 Jun 2026 09:40:43 +0000HIGH 7.5: Copyparty is a portable file server. Versions prior to 1.18.9, the filter parameter for the "Recent Uploads" page allows arbitrary RegExes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks the server. This is fixed in version 1.18.9.https://patchthecve.com/cve/CVE-2025-54589.htmlhttps://patchthecve.com/cve/CVE-2025-54589.htmlWed, 17 Jun 2026 09:40:21 +0000MEDIUM 6.3: Copyparty is a portable file server. In versions 1.18.6 and below, when accessing the recent uploads page at `/?ru`, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which reflects its value directly into a `<script>` block without propehttps://patchthecve.com/cve/CVE-2025-54423.htmlhttps://patchthecve.com/cve/CVE-2025-54423.htmlWed, 17 Jun 2026 09:40:04 +0000MEDIUM 5.4: copyparty is a portable file server. In versions up to and including versions 1.18.4, an unauthenticated attacker is able to execute arbitrary JavaScript code in a victim's browser due to improper sanitization of multimedia tags in music files, including m3u files. This is fixed in version 1.18.5.https://patchthecve.com/cve/CVE-2025-27145.htmlhttps://patchthecve.com/cve/CVE-2025-27145.htmlWed, 17 Jun 2026 09:03:05 +0000LOW 3.6: copyparty, a portable file server, has a DOM-based cross-site scripting vulnerability in versions prior to 1.16.15. The vulnerability is considered low-risk. By handing someone a maliciously-named file, and then tricking them into dragging the file into copyparty's Web-UI, an attacker could execute