Reflected XSS in Copyparty File Server via URL Parameter

Executive Summary

CVE-2026-27948 is a reflected cross-site scripting (XSS) vulnerability in the copyparty file server software versions prior to 1.20.9. It arises from improper handling of the URL parameter `?setck=...`, which allows an attacker to inject malicious JavaScript code. This happens because the parameter was not properly validated or sanitized, enabling the execution of arbitrary scripts when a user clicks on a crafted link.

The vulnerability was fixed by introducing strict validation on the `setck` parameter, restricting allowed characters to lowercase letters, digits, and the equals sign, limiting the length to 9 characters, and refining cookie unescaping logic to reduce the risk of malicious payloads being processed.

Useful 0 Not Useful 0

Impact Analysis

[{'type': 'paragraph', 'content': "Exploitation of this vulnerability can allow an attacker to execute malicious JavaScript in the context of the victim's browser by tricking them into clicking a specially crafted link containing the vulnerable `?setck=...` parameter."}, {'type': 'paragraph', 'content': "This can lead to unauthorized actions such as moving, deleting, or uploading files on the copyparty server using the victim’s account, potentially compromising the integrity and confidentiality of the server's data."}, {'type': 'paragraph', 'content': 'All attack attempts are logged in both the copyparty server log and the reverse proxy access log, which can help in detecting exploitation attempts.'}] [2]

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring logs for attempts to exploit the reflected XSS via the URL parameter `?setck=...`.'}, {'type': 'paragraph', 'content': 'Specifically, all attack attempts, whether successful or not, are logged in both the copyparty server log and the reverse proxy access log.'}, {'type': 'paragraph', 'content': 'A suggested command to detect such attempts is to search the logs using the following pattern:'}, {'type': 'list_item', 'content': 'grep -E \'[?&]setck=[^&"]*%\' /path/to/logfile'}, {'type': 'paragraph', 'content': 'This command looks for URL parameters containing `setck` with suspicious encoded characters, which may indicate exploitation attempts.'}] [2]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade the copyparty software to version 1.20.9 or later, where the vulnerability is fixed.

The fix includes strict validation of the `setck` URL parameter to restrict allowed characters and length, preventing malicious input.

Additionally, the cookie handling logic was improved to limit unescaping to trusted cookie names, reducing the risk of XSS.

Until the upgrade can be applied, monitoring logs for exploitation attempts and blocking suspicious requests at the reverse proxy or firewall level may help reduce risk.

Useful 0 Not Useful 0