PyPI/copyparty CVE-2026-32109: low 3.7, EPSS 0.17%

Copyparty has unexpected JavaScript execution via crafted URL to folder with `.prologue.html`

Action: Upgrade copyparty to 1.20.12 or later.

pip install copyparty==1.20.12

Affected

Fixed versions

Sources

• osv: GHSA-rcp6-88mm-9vgf
• https://github.com/9001/copyparty/security/advisories/GHSA-rcp6-88mm-9vgf
• https://nvd.nist.gov/vuln/detail/CVE-2026-32109
• https://github.com/9001/copyparty
• https://github.com/pypa/advisory-database/tree/main/vulns/copyparty/PYSEC-2026-32.yaml

CVE-2026-32109 · published 2026-03-12T14:22:53Z · modified 2026-06-05T18:00:13.902163811Z · JSON