Copyparty, a portable file server, has a reflected cross‑site scripting flaw in its setck URL parameter. The vulnerability allows an attacker to inject malicious JavaScript that executes in the victim’s browser, potentially exposing cookies, session tokens, or other sensitive data. This flaw falls under the input‑validation weakness identified as CWE‑79.

Versions of Copyparty less than 1.20.9 are affected. The software is available as a self‑hosted file sharing service.

The CVSS score of 5.4 indicates a moderate risk, while the EPSS score of less than 1% shows that the probability of exploitation is very low at present. The flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker must supply a crafted URL containing the setck parameter and persuade a victim to visit the link, making user interaction a prerequisite for exploitation. Nonetheless, the impact on confidentiality warrants prompt remedial action.