Copyparty Reflected Cross-Site Scripting Vulnerability in Recent Uploads Page

A reflected cross-site scripting vulnerability has been identified in Copyparty, a portable file server, affecting versions through 1.18.6. The issue arises on the recent uploads page, where users can apply filters using an input field. This field directly reflects its value into a script block without proper escaping, creating an opportunity for cross-site scripting. Both authenticated and unauthenticated users can exploit this vulnerability.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can execute arbitrary JavaScript in the context of the victim's browser.

Reproduction

To reproduce this vulnerability, access the recent uploads page and use the filter input field to submit a script tag, such as one containing JavaScript code like 'alert(1)'.

Remediation

Users can upgrade to Copyparty version 1.18.7 to address this vulnerability.