CVE-2026-27948
Reflected XSS in Copyparty File Server via URL Parameter
Publication date: 2026-02-26
Last updated on: 2026-02-28
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| 9001 | copyparty | to 1.20.9 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-27948 is a reflected cross-site scripting (XSS) vulnerability in the copyparty file server software versions prior to 1.20.9. It arises from improper handling of the URL parameter `?setck=...`, which allows an attacker to inject malicious JavaScript code. This happens because the parameter was not properly validated or sanitized, enabling the execution of arbitrary scripts when a user clicks on a crafted link.
The vulnerability was fixed by introducing strict validation on the `setck` parameter, restricting allowed characters to lowercase letters, digits, and the equals sign, limiting the length to 9 characters, and refining cookie unescaping logic to reduce the risk of malicious payloads being processed.
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': "Exploitation of this vulnerability can allow an attacker to execute malicious JavaScript in the context of the victim's browser by tricking them into clicking a specially crafted link containing the vulnerable `?setck=...` parameter."}, {'type': 'paragraph', 'content': "This can lead to unauthorized actions such as moving, deleting, or uploading files on the copyparty server using the victim’s account, potentially compromising the integrity and confidentiality of the server's data."}, {'type': 'paragraph', 'content': 'All attack attempts are logged in both the copyparty server log and the reverse proxy access log, which can help in detecting exploitation attempts.'}] [2]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring logs for attempts to exploit the reflected XSS via the URL parameter `?setck=...`.'}, {'type': 'paragraph', 'content': 'Specifically, all attack attempts, whether successful or not, are logged in both the copyparty server log and the reverse proxy access log.'}, {'type': 'paragraph', 'content': 'A suggested command to detect such attempts is to search the logs using the following pattern:'}, {'type': 'list_item', 'content': 'grep -E \'[?&]setck=[^&"]*%\' /path/to/logfile'}, {'type': 'paragraph', 'content': 'This command looks for URL parameters containing `setck` with suspicious encoded characters, which may indicate exploitation attempts.'}] [2]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade the copyparty software to version 1.20.9 or later, where the vulnerability is fixed.
The fix includes strict validation of the `setck` URL parameter to restrict allowed characters and length, preventing malicious input.
Additionally, the cookie handling logic was improved to limit unescaping to trusted cookie names, reducing the risk of XSS.
Until the upgrade can be applied, monitoring logs for exploitation attempts and blocking suspicious requests at the reverse proxy or firewall level may help reduce risk.