Copyparty 1.18.6 - Reflected Cross-Site Scripting (XSS)

Impact

For European organizations, the reflected XSS vulnerability in Copyparty 1.18.6 could lead to unauthorized access to user sessions, theft of sensitive information such as authentication tokens, and potential spread of malware through malicious scripts. Organizations using Copyparty for internal or external file sharing risk exposing their users to phishing or session hijacking attacks. This could result in data breaches, loss of user trust, and compliance violations under regulations like GDPR. Public-facing Copyparty instances are particularly at risk, as attackers can lure users into clicking malicious links. The impact on confidentiality and integrity is significant, though availability is less likely to be affected. The presence of exploit code increases the likelihood of targeted attacks, especially against organizations with lax input validation or insufficient web security controls.