CVE-2026-32109
2 advisories.
PyPI/copyparty CVE-2026-32109: low 3.7, EPSS 0.20%
Copyparty has unexpected JavaScript execution via crafted URL to folder with `.prologue.html`
Action: Upgrade copyparty to 1.20.12 or later.
pip install copyparty==1.20.12Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.20.12 | - |
Fixed versions
| 1.20.12 |
Sources
- osv: GHSA-rcp6-88mm-9vgf
- https://github.com/9001/copyparty/security/advisories/GHSA-rcp6-88mm-9vgf
- https://nvd.nist.gov/vuln/detail/CVE-2026-32109
- https://github.com/9001/copyparty
- https://github.com/pypa/advisory-database/tree/main/vulns/copyparty/PYSEC-2026-32.yaml
CVE-2026-32109 · published · modified · JSON
PyPI/copyparty CVE-2026-32109: medium 4.4, EPSS 0.20%
Copyparty is a portable file server. Prior to 1.20.12, if an attacker has been given both read- and write-permissions to the server, they can upload a malicious file with the filename .prologue.html a
Action: Upgrade copyparty to 1.20.12 or later.
pip install copyparty==1.20.12Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.20.12 | - |
Fixed versions
| 1.20.12 |
Sources
CVE-2026-32109 · published · modified · JSON