CVE-2023-38501
MediumCVSS 6.3Exploitation Probability (EPSS)
Very high risk93th percentile - higher than 93% of all known CVEs
Summary
The copyparty file server software prior to version 1.8.7 contains a reflected XSS vulnerability via URL parameters `?k304=...` and `?setck=...`. This can lead to moving or deleting existing files on the server, as well as uploading new files using the account of the person who clicks the malicious link.
Risk Assessment
The organization may lose control over its files, leading to potential data loss and security breaches. Users may be exposed to attacks that could result in unauthorized access to their accounts.
Recommendation
It is recommended to change the passwords of copyparty accounts unless logs have been inspected and no traces of attacks were found. Additionally, the software should be updated to version 1.8.7, which contains a patch for this vulnerability.
Other vulnerabilities in copyparty
See all- CVE-2023-37474High
Copyparty is a portable file server that is vulnerable to a path traversal attack in the `.cpr` subfolder in versions prior to 1.8.2. This attack allows access to files, directories, and commands outside the web document root directory.
- CVE-2026-70657Medium
Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the containing folder. This vulnerability was only reachable if both types of keys (filekeys and dirkeys) were manually enabled in the volume flags simultaneously. This issue is fixed in version 1.20.17.
Original NVD description (English source)
copyparty is file server software. Prior to version 1.8.7, the application contains a reflected cross-site scripting via URL-parameter `?k304=...` and `?setck=...`. The worst-case outcome of this is being able to move or delete existing files on the server, or upload new files, using the account of the person who clicks the malicious link. It is recommended to change the passwords of one's copyparty accounts, unless one have inspected one's logs and found no trace of attacks. Version 1.8.7 contains a patch for the issue.