CVE-2026-32109
Cross-Site Scripting in Copyparty File Server via .prologue.html Upload
Publication date: 2026-03-11
Last updated on: 2026-03-13
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| 9001 | copyparty | to 1.20.12 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects Copyparty, a portable file server, in versions prior to 1.20.12. If an attacker has both read and write permissions on the server, they can upload a malicious file named .prologue.html. By crafting a specific link, the attacker can cause arbitrary JavaScript within that file to execute in the victim's browser context unexpectedly.
Normally, JavaScript in .prologue.html executes only when the user accesses the file directly (e.g., https://example.com/foo/.prologue.html). The vulnerability is that the JavaScript also executes when accessing a URL like https://example.com/foo/?b, which is unexpected behavior.
Exploitation requires the victim to click a specially crafted link, and existing security measures such as strict SameSite cookies make exploitation harder. Additionally, the attacker would need to have sufficient permissions to upload or modify resources on the server.
This issue was fixed in Copyparty version 1.20.12.
How can this vulnerability impact me? :
If exploited, this vulnerability can lead to the execution of arbitrary JavaScript code in the context of a victim's browser session when they click a crafted link. This could potentially allow an attacker to perform actions on behalf of the victim within the web application.
However, the impact is limited by several factors: the attacker must have both read and write permissions on the server, the victim must click the malicious link, and strict SameSite cookie policies reduce the risk of session hijacking.
The CVSS score of 3.7 (low severity) reflects that the vulnerability requires user interaction and has limited impact on confidentiality and integrity.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade Copyparty to version 1.20.12 or later, where the issue is fixed.
Additionally, ensure that users do not click on crafted links that exploit the vulnerability, especially links with query parameters that cause unexpected JavaScript execution.
Restrict read and write permissions carefully to prevent attackers from uploading malicious .prologue.html files.