CVE-2026-32109: Copyparty JavaScript Execution via Malicious .prologue.html File
Summary
CVE-2026-32109: Copyparty has unexpected JavaScript execution via crafted URL to folder with .prologue.html. Affects copyparty versions < 1.20.12. Fixed in 1.20.12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Copyparty is an open-source file sharing server that allows users to share files over the web. It is designed for ease of use and flexibility, enabling users to upload, download, and manage files through a web interface. However, it has a vulnerability that allows for unexpected JavaScript execution through crafted URLs when a malicious file named '.prologue.html' is uploaded by an attacker with read and write permissions.
Vulnerability Detail
The vulnerability arises when an attacker uploads a file named '.prologue.html' to a folder on the Copyparty server. If a user clicks a crafted link to this file, such as 'https://example.com/foo/?b', the server evaluates the file and executes the JavaScript contained within it. This behavior is unexpected as the JavaScript should only execute when directly accessing the file. The implications of this vulnerability are significant, as it could allow an attacker to manipulate files on the server using the victim's authenticated session, potentially leading to data loss or unauthorized access.
How To Fix
Latest published version: 1.20.26 as of 22 Oct 2026
pip install --upgrade "copyparty==1.20.26"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.20.12
This is the first release that contains the fix.
pip install --upgrade "copyparty==1.20.12"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that users do not click on untrusted links that could lead to the execution of malicious JavaScript. Additionally, consider implementing strict access controls to limit who can upload files to the server.
Conclusion
The CVE-2026-32109 vulnerability in Copyparty poses a risk of unexpected JavaScript execution through crafted URLs. Users are advised to update to the latest version to patch this vulnerability and implement best practices to secure their applications.
See every vulnerability recorded for copyparty →
FAQ
The vulnerability allows for unexpected JavaScript execution via crafted URLs to a malicious '.prologue.html' file uploaded to the server.
Any user of Copyparty who has been granted read and write permissions on the server is potentially affected.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors for open-source vulnerabilities without requiring signup.
If exploited, the malicious JavaScript could delete or move files on the server or upload new files using the victim's account.
Implementing strict SameSite cookies and ensuring users do not click on untrusted links can help mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for copyparty.
