# CVE-2026-27948: copyparty XSS β€” Fixed in 1.20.9 🐍 🐍 PyPI Not in CISA KEV MEDIUM severity # CVE-2026-27948 β€” copyparty MEDIUM [Fix: 9001/copyparty@31b2801](https://github.com/9001/copyparty/commit/31b2801fd041f803f4a3d5c12c7d7cb5419048bc) CVE-2026-27948 is a medium-severity (CVSS 5.4) Cross-site Scripting (XSS) vulnerability in copyparty. A fix is available for copyparty β€” see the affected versions and patch details below. Copyparty vulnerable to eflected cross-site scripting via setck parameter Also known as[GHSA-62cr-6wp5-q43h](/vulnerability/GHSA-62cr-6wp5-q43h)PYSEC-2026-2136 Published Feb 26, 2026 Updated Oct 28, 2026 Affected 1 pkg Patched 1 / 1 Exploits None indexed Exploitation data as of Nov 6, 2026 Β· OSV.dev, NVD, FIRST.org (EPSS) ## Exploitation Status ### No confirmed exploitation observed yet - CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment. Exploitation and automatability from CISA’s SSVC triage for CVE-2026-27948. ## EPSS Exploitation Probability [via FIRST.org β†—](https://www.first.org/epss/) 0.2%probability of exploitation in next 30 days Lower Risk0.00% Lower risk than most CVEs9th percentile β€” riskier than 9% of all scored CVEsHighest risk 0.00%0.26%0.52%0.77%0.0%0.2%May 26Sep 26Nov 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## How urgent is this, really ## Where this sits among everything scored ## Real-World Exposure 1 pkg affected 🐍`copyparty` Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages β€” download data is not available via public APIs for these ecosystems. ## Description #### Summary An XSS allows for reflected cross-site scripting via URL-parameter `?setck=...` #### Details A reflected cross-site scripting (XSS) vulnerability could allow an attacker to execute malicious javascript by tricking users into accessing a malicious link. The worst-case outcome of this is being able to move or delete existing files on the server, or upload new files, using the account of the person who clicks the malicious link. #### Indicators of Compromise All attempted attacks (successful or not) would be logged to both the copyparty serverlog and the accesslog of the reverseproxy, and are detected by `grep -E '[?&]setck=[^&"]*%'` (the text `setck=` eventually followed by the `%` character). ## Affected Packages 1 total 1 fixed Ecosystem Package Vulnerable range Fix 🐍PyPI `copyparty` all versions 1.20.9`pip install --upgrade 'copyparty==1.20.9'` ## Affected Products 1 product Β· 1 configurations Application `copyparty`9001 < 1.20.9 range ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for copyparty, including transitive dependencies β€” a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update copyparty to 1.20.9 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range β€” O3 confirms CVE-2026-27948 is resolved across your whole dependency graph. 3. ### Workarounds Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page. ## Frequently Asked Questions \### Summary An XSS allows for reflected cross-site scripting via URL-parameter \`?setck=...\` ### Details A reflected cross-site scripting (XSS) vulnerability could allow an attacker to execute malicious javascript by tricking users into accessing a malicious link. The worst-case outcome of this is being able to move or delete existing files on the server, or upload new files, using the account of the person who clicks the malicious link. ### Indicators of Compromise All attempted attacks (successful or not) would be logged to both the copyparty serverlog and the accesslog of the reverseproxy O3 Security Β· Impact-Aware SCA ### Is CVE-2026-27948 in your dependencies? Find it across PyPI, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)