{"action":"Upgrade copyparty to 1.18.9 or later.","affected":[{"fixed":"1.18.9","introduced":"0"}],"component":"copyparty","cve_ids":["CVE-2025-54796"],"ecosystem":"PyPI","epss":0.00461,"exploited":false,"fixed_versions":["1.18.9"],"ghsa_id":"GHSA-5662-2rj7-f2v6","id":"tcs_01M5KGRKWF7N9EACXKY265RT7E","modified_at":"2026-07-07T17:47:20.703758357Z","published_at":"2026-07-07T16:03:00.228871Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1275","https://github.com/9001/copyparty/security/advisories/GHSA-5662-2rj7-f2v6","https://nvd.nist.gov/vuln/detail/CVE-2025-54796","https://github.com/9001/copyparty/commit/09910ba80784c3980947d92f45db696398c0fd83","https://github.com/9001/copyparty","https://github.com/9001/copyparty/releases/tag/v1.18.9","https://pypi.org/project/copyparty","https://github.com/advisories/GHSA-5662-2rj7-f2v6"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"PYSEC-2026-1275","url":"https://osv.dev/vulnerability/PYSEC-2026-1275"}],"summary":"copyparty allows Regex Denial of Service (ReDoS) in the upload listing"}