CVE-2023-38501 Scanner
Detects 'Cross-Site Scripting (XSS)' vulnerability in Copyparty affects v. prior to 1.8.6.
Used 2k times · 3.4k assets checked · url
CVE
CVE-2023-38501
6.1
CVSSmedium
Exploitable remotely over the internet · no authentication required · user interaction needed.
Description
copyparty is file server software. Prior to version 1.8.7, the application contains a reflected cross-site scripting via URL-parameter `?k304=...` and `?setck=...`. The worst-case outcome of this is being able to move or delete existing files on the server, or upload new files, using the account of the person who clicks the malicious link. It is recommended to change the passwords of one's copyparty accounts, unless one have inspected one's logs and found no trace of attacks. Version 1.8.7 contains a patch for the issue.
Attack Vector
Network
Privileges Req.
None
User Interaction
Required
copyparty
Updated Sep 28, 2026View on NVD →
S4E scanner
CVE history: copyparty
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →