| Package | Affected versions | Patched versions |
|---|---|---|
| copyparty | < 1.18.9 | 1.18.9 |
| copyparty | < 1.18.9 | 1.18.9 |
The filter parameter for the "Recent uploads" page allows arbitrary Regexes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks the server.
https://127.0.0.1:3923/?ru&filter=(.+)+x
The server becomes fully inaccessible for a long time.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free