Copyparty Cross-Site Scripting Vulnerability in WEEKEND-PLANS Function

A cross-site scripting vulnerability has been identified in Copyparty version 1.9.1. This issue allows local attackers to execute arbitrary code by sending a crafted payload to the WEEKEND-PLANS function.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject and execute malicious scripts in the context of the user's browser.

Reproduction

To reproduce this vulnerability, upload a markdown file to the WEEKEND-PLANS function. Include a payload that exploits the cross-site scripting vulnerability, such as a script tag or an event handler. Once the file is uploaded, the injected script will be executed, demonstrating the successful exploitation of the vulnerability.