https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 11:50:09 +0000 https://cve.radiocsirt.org/vuln/cve-2026-32109 <p><strong>Affected:</strong> 9001 copyparty</p> <p>Copyparty is a portable file server. Prior to 1.20.12, if an attacker has been given both read- and write-permissions to the server, they can upload a malicious file with the filename .prologue.html and then craft a link to potentially execute arbitrary JavaScript in the victim&#39;s context. Note that it is intended behavior that the JavaScript would execute if the target clicks a link to the HTML file itself; &#34;https://example.com/foo/.prologue.html&#34;. The vulnerability is that &#34;https://example.com/foo/?b&#34; would also evaluate the file, making the behavior unexpected. There are existing preventative measures (strict SameSite cookies) which makes it harder to leverage this vulnerability in an attack; in order to gain control of the target&#39;s authenticated session, the link must be clicked from a page served by the server itself -- most likely by editing an existing resource, which would require additional access permissions. Finally, for this attack to be successful, the attacker&#39;s target must click the specific crafted link given by the attacker. This vulnerability is not activated by normally browsing the web-UI on the server. This vulnerability is fixed in 1.20.12.</p> <p><strong>Affected:</strong> 9001 copyparty</p> <p>Copyparty is a portable file server. Prior to 1.20.12, if an attacker has been given both read- and write-permissions to the server, they can upload a malicious file with the filename .prologue.html and then craft a link to potentially execute arbitrary JavaScript in the victim&#39;s context. Note that it is intended behavior that the JavaScript would execute if the target clicks a link to the HTML file itself; &#34;https://example.com/foo/.prologue.html&#34;. The vulnerability is that &#34;https://example.com/foo/?b&#34; would also evaluate the file, making the behavior unexpected. There are existing preventative measures (strict SameSite cookies) which makes it harder to leverage this vulnerability in an attack; in order to gain control of the target&#39;s authenticated session, the link must be clicked from a page served by the server itself -- most likely by editing an existing resource, which would require additional access permissions. Finally, for this attack to be successful, the attacker&#39;s target must click the specific crafted link given by the attacker. This vulnerability is not activated by normally browsing the web-UI on the server. This vulnerability is fixed in 1.20.12.</p> https://cve.radiocsirt.org/vuln/cve-2026-32109