CVE-2026-32109: 
Python vulnerability analysis and mitigation

CVE-2026-32109 is a stored Cross-Site Scripting (XSS) vulnerability in Copyparty, a portable file server, that allows an attacker with both read and write permissions to execute arbitrary JavaScript in a victim's browser context. The vulnerability affects all Copyparty versions prior to 1.20.12 and was disclosed on March 11, 2026. It carries a CVSS v3.1 base score of 3.7 (Low) (GitHub Advisory, Copyparty Advisory).

The root cause is improper neutralization of user-controlled input during web page generation (CWE-79). Copyparty supports a special file named .prologue.html that, when present in a directory, is intended to render only when the file itself is directly accessed (e.g., https://example.com/foo/.prologue.html). The vulnerability arises because the file is also unexpectedly evaluated when a user visits a crafted directory URL with a query parameter (e.g., https://example.com/foo/?b), causing any embedded JavaScript to execute in the visitor's browser. Exploitation requires the attacker to have both read and write permissions on the server, and the victim must click a specifically crafted link (Copyparty Advisory, GitHub Advisory).

If successfully exploited, the malicious JavaScript executes in the context of the authenticated victim's session, potentially enabling an attacker to move, delete, or upload files on the server using the victim's account privileges. Confidentiality and integrity impacts are low, and there is no availability impact. Session hijacking is further constrained by strict SameSite cookie protections, which require the malicious link to be clicked from a page served by the server itself — limiting the practical attack surface (GitHub Advisory, Copyparty Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.01% (1st percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Multiple preconditions significantly limit exploitability: the attacker must hold both read and write permissions on the server, and the victim must click a specific attacker-crafted link (GitHub Advisory).

1. Obtain permissions: Acquire both read and write permissions on the target Copyparty server (e.g., via a legitimate or compromised account).
2. Upload malicious file: Upload a file named .prologue.html to a target directory on the server, embedding a malicious JavaScript payload within the HTML content (e.g., a script that exfiltrates session data or performs file operations via the Copyparty API).
3. Craft malicious link: Construct a URL pointing to the directory containing the uploaded file with a query parameter, such as https://example.com/foo/?b, which triggers unexpected evaluation of .prologue.html.
4. Deliver link to victim: Send the crafted link to the target victim, ideally from within the server's own web UI (e.g., by editing an existing resource or sharing a link in a comment), to satisfy the SameSite cookie restriction.
5. JavaScript executes: When the victim clicks the link, the .prologue.html file is evaluated and the embedded JavaScript runs in the victim's authenticated browser session, potentially enabling file manipulation or session abuse (Copyparty Advisory, GitHub Advisory).

• File System: Presence of a file named .prologue.html in any server directory, especially if not created by a known administrator; review upload logs for this filename.
• Logs: Server access logs showing requests to directory URLs with query parameters (e.g., GET /foo/?b) shortly after a .prologue.html file was uploaded to that directory.
• Network: Unexpected outbound HTTP requests from a user's browser session to external domains following access to a directory URL, which may indicate JavaScript-based data exfiltration.
• File Activity: Unexpected file moves, deletions, or uploads occurring under a user's account that the user did not initiate, potentially indicating JavaScript-driven file manipulation via the Copyparty API (Copyparty Advisory).

Upgrade Copyparty to version 1.20.12 or later, which contains the fix for this vulnerability (GitHub Advisory, Copyparty Advisory). As a workaround prior to patching, restrict write permissions on the server to only fully trusted users, which prevents an attacker from uploading the malicious .prologue.html file. Additionally, monitor for unexpected .prologue.html files in server directories and educate users to avoid clicking unfamiliar links shared within the application.