5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27948

CVE-2026-27948: Copyparty vulnerable to eflected cross-site scripting via setck parameter

Copyparty is a portable file server. In versions prior to 1.20.9, an XSS allows for reflected cross-site scripting via URL-parameter ?setck=.... Version 1.20.9 fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27948

CVE-2026-27948:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
copyparty	pip	< 1.20.9	1.20.9

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a reflected Cross-Site Scripting (XSS) issue in the copyparty application, triggered via the setck URL parameter. The root cause is the lack of input validation in the setck function within copyparty/httpcli.py. An attacker could craft a malicious URL with a crafted setck parameter containing javascript code. When a user clicks this link, the setck function would process the malicious parameter and reflect it into a Set-Cookie header. The browser would then execute the javascript in the context of the user's session. The patch addresses this by introducing strict validation on the setck parameter's content and length within the setck function. Additionally, the unescape_cookie function in copyparty/util.py was hardened to limit the length of cookie values as a defense-in-depth measure, and the run function in copyparty/httpcli.py was updated to support this change.

Vulnerable functions

setck

copyparty/httpcli.py

The `setck` function directly processes the user-controlled `setck` URL parameter. The original code lacked input validation and used `split('=', 1)`, allowing an attacker to inject malicious characters that would be reflected in the `Set-Cookie` header, leading to a cross-site scripting (XSS) vulnerability.

run

copyparty/httpcli.py

The `run` function is the main request handler which parses cookies. It calls the `unescape_cookie` function. The patch modifies this call to pass the cookie name to `unescape_cookie` for additional security checks, indicating that the previous implementation was insufficient and contributed to the vulnerability.

unescape_cookie

copyparty/util.py

The `unescape_cookie` function was modified to limit the length of cookie values for cookies not named 'cppw*'. This change suggests that the original implementation could be exploited to create malicious cookie values, contributing to the XSS vulnerability. This function is part of the vulnerable data flow.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.