https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 22:47:38 +0000 https://db.gcve.eu/vuln/cve-2026-32109 <p><strong>Affected:</strong> 9001 copyparty</p> <p>Copyparty is a portable file server. Prior to 1.20.12, if an attacker has been given both read- and write-permissions to the server, they can upload a malicious file with the filename .prologue.html and then craft a link to potentially execute arbitrary JavaScript in the victim&#39;s context. Note that it is intended behavior that the JavaScript would execute if the target clicks a link to the HTML file itself; &#34;https://example.com/foo/.prologue.html&#34;. The vulnerability is that &#34;https://example.com/foo/?b&#34; would also evaluate the file, making the behavior unexpected. There are existing preventative measures (strict SameSite cookies) which makes it harder to leverage this vulnerability in an attack; in order to gain control of the target&#39;s authenticated session, the link must be clicked from a page served by the server itself -- most likely by editing an existing resource, which would require additional access permissions. Finally, for this attack to be successful, the attacker&#39;s target must click the specific crafted link given by the attacker. This vulnerability is not activated by normally browsing the web-UI on the server. This vulnerability is fixed in 1.20.12.</p> <p><strong>Affected:</strong> 9001 copyparty</p> <p>Copyparty is a portable file server. Prior to 1.20.12, if an attacker has been given both read- and write-permissions to the server, they can upload a malicious file with the filename .prologue.html and then craft a link to potentially execute arbitrary JavaScript in the victim&#39;s context. Note that it is intended behavior that the JavaScript would execute if the target clicks a link to the HTML file itself; &#34;https://example.com/foo/.prologue.html&#34;. The vulnerability is that &#34;https://example.com/foo/?b&#34; would also evaluate the file, making the behavior unexpected. There are existing preventative measures (strict SameSite cookies) which makes it harder to leverage this vulnerability in an attack; in order to gain control of the target&#39;s authenticated session, the link must be clicked from a page served by the server itself -- most likely by editing an existing resource, which would require additional access permissions. Finally, for this attack to be successful, the attacker&#39;s target must click the specific crafted link given by the attacker. This vulnerability is not activated by normally browsing the web-UI on the server. This vulnerability is fixed in 1.20.12.</p> https://db.gcve.eu/vuln/cve-2026-32109 https://db.gcve.eu/vuln/ghsa-rcp6-88mm-9vgf <p><strong>Affected:</strong> PyPI: copyparty</p> <p>If an attacker has been given both read- and write-permissions to the server, they can upload a malicious file with the filename `.prologue.html` and then craft a link to potentially execute arbitrary JavaScript in the victim&#39;s context.</p> <p>Note that it is intended behavior that the JavaScript would execute if the target clicks a link to the HTML file itself; &#34;https://example.com/foo/.prologue.html&#34;. The vulnerability is that &#34;https://example.com/foo/?b&#34; would also evaluate the file, making the behavior unexpected.</p> <p>There are existing preventative measures (strict SameSite cookies) which makes it harder to leverage this vulnerability in an attack; in order to gain control of the target&#39;s authenticated session, the link must be clicked from a page served by the server itself -- most likely by editing an existing resource, which would require additional access permissions.</p> <p>Finally, for this attack to be successful, the attacker&#39;s target must click the specific crafted link given by the attacker. This vulnerability is not activated by normally browsing the web-UI on the server.</p> <p>## Impact</p> <p>If successful, the malicious JavaScript could move or delete existing files on the server, or upload new files, using the account of the person who opens the link.</p> <p><strong>Affected:</strong> PyPI: copyparty</p> <p>If an attacker has been given both read- and write-permissions to the server, they can upload a malicious file with the filename `.prologue.html` and then craft a link to potentially execute arbitrary JavaScript in the victim&#39;s context.</p> <p>Note that it is intended behavior that the JavaScript would execute if the target clicks a link to the HTML file itself; &#34;https://example.com/foo/.prologue.html&#34;. The vulnerability is that &#34;https://example.com/foo/?b&#34; would also evaluate the file, making the behavior unexpected.</p> <p>There are existing preventative measures (strict SameSite cookies) which makes it harder to leverage this vulnerability in an attack; in order to gain control of the target&#39;s authenticated session, the link must be clicked from a page served by the server itself -- most likely by editing an existing resource, which would require additional access permissions.</p> <p>Finally, for this attack to be successful, the attacker&#39;s target must click the specific crafted link given by the attacker. This vulnerability is not activated by normally browsing the web-UI on the server.</p> <p>## Impact</p> <p>If successful, the malicious JavaScript could move or delete existing files on the server, or upload new files, using the account of the person who opens the link.</p> https://db.gcve.eu/vuln/ghsa-rcp6-88mm-9vgf https://db.gcve.eu/vuln/pysec-2026-32 <p><strong>Affected:</strong> PyPI: copyparty</p> <p>Copyparty is a portable file server. Prior to 1.20.12, if an attacker has been given both read- and write-permissions to the server, they can upload a malicious file with the filename .prologue.html and then craft a link to potentially execute arbitrary JavaScript in the victim&#39;s context. Note that it is intended behavior that the JavaScript would execute if the target clicks a link to the HTML file itself; &#34;https://example.com/foo/.prologue.html&#34;. The vulnerability is that &#34;https://example.com/foo/?b&#34; would also evaluate the file, making the behavior unexpected. There are existing preventative measures (strict SameSite cookies) which makes it harder to leverage this vulnerability in an attack; in order to gain control of the target&#39;s authenticated session, the link must be clicked from a page served by the server itself -- most likely by editing an existing resource, which would require additional access permissions. Finally, for this attack to be successful, the attacker&#39;s target must click the specific crafted link given by the attacker. This vulnerability is not activated by normally browsing the web-UI on the server. This vulnerability is fixed in 1.20.12.</p> <p><strong>Affected:</strong> PyPI: copyparty</p> <p>Copyparty is a portable file server. Prior to 1.20.12, if an attacker has been given both read- and write-permissions to the server, they can upload a malicious file with the filename .prologue.html and then craft a link to potentially execute arbitrary JavaScript in the victim&#39;s context. Note that it is intended behavior that the JavaScript would execute if the target clicks a link to the HTML file itself; &#34;https://example.com/foo/.prologue.html&#34;. The vulnerability is that &#34;https://example.com/foo/?b&#34; would also evaluate the file, making the behavior unexpected. There are existing preventative measures (strict SameSite cookies) which makes it harder to leverage this vulnerability in an attack; in order to gain control of the target&#39;s authenticated session, the link must be clicked from a page served by the server itself -- most likely by editing an existing resource, which would require additional access permissions. Finally, for this attack to be successful, the attacker&#39;s target must click the specific crafted link given by the attacker. This vulnerability is not activated by normally browsing the web-UI on the server. This vulnerability is fixed in 1.20.12.</p> https://db.gcve.eu/vuln/pysec-2026-32