CVE-2025-54796 - Vulnerability Details - OpenCVE

Copyparty is a portable file server. Versions prior to 1.18.9, the filter parameter for the "Recent Uploads" page allows arbitrary RegExes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks the server. This is fixed in version 1.18.9.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable yes

Technical Impact partial

Vendors	Products
9001	Copyparty

No data.

No data.

References

Link	Providers
https://github.com/9001/copyparty/commit/09910ba80784c3980947d92f45db696398c0fd83
https://github.com/9001/copyparty/releases/tag/v1.18.9
https://github.com/9001/copyparty/security/advisories/GHSA-5662-2rj7-f2v6

History

Mon, 04 Aug 2025 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 04 Aug 2025 08:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		9001 9001 copyparty
Vendors & Products		9001 9001 copyparty

Sat, 02 Aug 2025 00:00:00 +0000

Type	Values Removed	Values Added
Description		Copyparty is a portable file server. Versions prior to 1.18.9, the filter parameter for the "Recent Uploads" page allows arbitrary RegExes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks the server. This is fixed in version 1.18.9.
Title		Copyparty is vulnerable to Regex Denial of Service (ReDoS) attacks through "Recent Uploads" page
Weaknesses		CWE-1333 CWE-400 CWE-833
References		https://github.com/9001/copyparty/commit/09910ba80784c3980947d92f45db696398c0fd83 https://github.com/9001/copyparty/releases/tag/v1.18.9 https://github.com/9001/copyparty/security/advisories/GHSA-5662-2rj7-f2v6
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2025-08-01T23:38:27.221Z

Updated: 2025-08-04T15:19:59.399Z

Reserved: 2025-07-29T16:50:28.395Z

Link: CVE-2025-54796

Vulnrichment

Updated: 2025-08-04T15:19:50.022Z

NVD

Status : Awaiting Analysis

Published: 2025-08-02T00:15:26.550

Modified: 2025-08-04T16:15:34.217

Link: CVE-2025-54796

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-54796", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-07-29T16:50:28.395Z", "datePublished": "2025-08-01T23:38:27.221Z", "dateUpdated": "2025-08-04T15:19:59.399Z"}, "containers": {"cna": {"title": "Copyparty is vulnerable to Regex Denial of Service (ReDoS) attacks through \"Recent Uploads\" page", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-1333", "lang": "en", "description": "CWE-1333: Inefficient Regular Expression Complexity", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-833", "lang": "en", "description": "CWE-833: Deadlock", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/9001/copyparty/security/advisories/GHSA-5662-2rj7-f2v6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/9001/copyparty/security/advisories/GHSA-5662-2rj7-f2v6"}, {"name": "https://github.com/9001/copyparty/commit/09910ba80784c3980947d92f45db696398c0fd83", "tags": ["x_refsource_MISC"], "url": "https://github.com/9001/copyparty/commit/09910ba80784c3980947d92f45db696398c0fd83"}, {"name": "https://github.com/9001/copyparty/releases/tag/v1.18.9", "tags": ["x_refsource_MISC"], "url": "https://github.com/9001/copyparty/releases/tag/v1.18.9"}], "affected": [{"vendor": "9001", "product": "copyparty", "versions": [{"version": "< 1.18.9", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-08-01T23:38:27.221Z"}, "descriptions": [{"lang": "en", "value": "Copyparty is a portable file server. Versions prior to 1.18.9, the filter parameter for the \"Recent Uploads\" page allows arbitrary RegExes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks the server. This is fixed in version 1.18.9."}], "source": {"advisory": "GHSA-5662-2rj7-f2v6", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/9001/copyparty/security/advisories/GHSA-5662-2rj7-f2v6", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-04T15:19:56.634822Z", "id": "CVE-2025-54796", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-04T15:19:59.399Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-54796", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-04T15:19:56.634822Z"}}}], "references": [{"url": "https://github.com/9001/copyparty/security/advisories/GHSA-5662-2rj7-f2v6", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-04T15:19:50.022Z"}}], "cna": {"title": "Copyparty is vulnerable to Regex Denial of Service (ReDoS) attacks through \"Recent Uploads\" page", "source": {"advisory": "GHSA-5662-2rj7-f2v6", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "9001", "product": "copyparty", "versions": [{"status": "affected", "version": "< 1.18.9"}]}], "references": [{"url": "https://github.com/9001/copyparty/security/advisories/GHSA-5662-2rj7-f2v6", "name": "https://github.com/9001/copyparty/security/advisories/GHSA-5662-2rj7-f2v6", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/9001/copyparty/commit/09910ba80784c3980947d92f45db696398c0fd83", "name": "https://github.com/9001/copyparty/commit/09910ba80784c3980947d92f45db696398c0fd83", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/9001/copyparty/releases/tag/v1.18.9", "name": "https://github.com/9001/copyparty/releases/tag/v1.18.9", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Copyparty is a portable file server. Versions prior to 1.18.9, the filter parameter for the \"Recent Uploads\" page allows arbitrary RegExes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks the server. This is fixed in version 1.18.9."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1333", "description": "CWE-1333: Inefficient Regular Expression Complexity"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-833", "description": "CWE-833: Deadlock"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-08-01T23:38:27.221Z"}}}, "cveMetadata": {"cveId": "CVE-2025-54796", "state": "PUBLISHED", "dateUpdated": "2025-08-04T15:19:59.399Z", "dateReserved": "2025-07-29T16:50:28.395Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-08-01T23:38:27.221Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}