v1.20.9

9001/copypartyv1.20.9Feb 25, 2026by 9001

AI Summary

Critical security release fixing CVE-2026-27948, an XSS vulnerability that could allow arbitrary JavaScript execution via malicious links. Includes webdav port configuration option.

Key Highlights

SECURITY: Fixed XSS vulnerability (GHSA-62cr-6wp5-q43h)
Added dav-port as alternative to daw for webdav configuration
Known issue: login broken (fixed in v1.20.10)

New Features

XSS vulnerability fix
WebDAV port configuration option (dav-port)

Full Release Notes

<img src="https://github.com/9001/copyparty/raw/hovudstraum/docs/logo.svg" width="250" align="right"/>

* read-only demo server at https://a.ocv.me/pub/demo/
* [docker image](https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker) ╱ [similar software](https://github.com/9001/copyparty/blob/hovudstraum/docs/versus.md) ╱ [client testbed](https://cd.ocv.me/b/)

there is a [discord server](https://discord.gg/25J8CdTT6G) with an `@everyone` in case of future important updates, such as [vulnerabilities](https://github.com/9001/copyparty/security) (most recently 2026-02-25)

## ⚠️ ATTN: this release fixes an XSS vulnerability

[GHSA-62cr-6wp5-q43h](https://github.com/9001/copyparty/security/advisories/GHSA-62cr-6wp5-q43h) could let an attacker execute arbitrary JS by tricking you into clicking a malicious link 31b2801f

# known issue: login broken, fix roughly 8pm UTC tonight 

## 🔧 other changes

* webdav: [dav-port](https://copyparty.eu/cli/#g-dav-port) can be used as an alternative to [daw](https://copyparty.eu/cli/#g-daw) d21242fc

----

## ⚠️ not the [latest version](https://github.com/9001/copyparty/releases/latest/)!