{"items":[{"id":"NVI-00020080","kind":"vulnerability","title":"Copyparty has unexpected JavaScript execution via crafted URL to folder with `.prologue.html`","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-rcp6-88mm-9vgf","CVE-2026-32109"],"plain_summary":"GitHub lists this reviewed advisory for copyparty. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-741aa74ea9f97f7bab34a755fd88582b"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-05T17:51:18.000Z","value":"3.7 low","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-741aa74ea9f97f7bab34a755fd88582b"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-741aa74ea9f97f7bab34a755fd88582b","url":"https://github.com/advisories/GHSA-rcp6-88mm-9vgf","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-rcp6-88mm-9vgf","publisher":"GitHub Advisory Database","observed_at":"2026-11-07T00:52:58.259Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-741aa74ea9f97f7bab34a755fd88582b"],"technology":"copyparty","known_exclusions":[],"conditions_summary":"If an attacker has been given both read- and write-permissions to the server, they can upload a malicious file with the filename `.prologue.html` and then craft a link to potentially execute arbitrary JavaScript in the victim's context.\n\nNote that it is intended behavior that the JavaScript would execute if the target clicks a link to the HTML file itself; \"https://example.com/foo/.prologue.html\". The vulnerability is that \"https://example.com/foo/?b\" would also evaluate the file, making the behavior unexpected.\n\nThere are existing preventative measures (strict SameSite cookies) which makes it harder to leverage this vulnerability in an attack; in order to gain control of the target's authenticated session, the link must be clicked from a page served by the server itself -- most likely by editing an existing resource, which would require additional access permissions.\n\nFinally, for this attack to be successful, the attacker's target must click the specific crafted link given by the attacker. This vulnerability is not activated by normally browsing the web-UI on the server.\n\n## Impact\n\nIf successful, the malicious JavaScript could move or delete existing files on the server, or uplo","public_affected_ranges":["< 1.20.12"]}],"null_published_at":"2026-11-08T15:11:47.523Z","source_updated_at":"2026-06-05T17:51:18.000Z","source_disclosed_at":"2026-03-12T14:22:53.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-07T00:52:58.259Z"}],"next_cursor":null,"snapshot_revision":"42594"}