This vulnerability allows an attacker who can write to the Copyparty server to upload a file named ".prologue.html" containing malicious JavaScript. Normally the script would run only when the file is accessed directly via a URL such as https://example.com/foo/.prologue.html. However, the server also evaluates the file when accessing the directory with a query string, e.g., https://example.com/foo/?b. Consequently, an attacker can craft a link that causes the JavaScript to execute in an unsuspecting victim’s browser. Because the script runs with the victim’s authenticated session, the attacker can perform actions such as session hijacking, data exfiltration, or further exploitation. The weakness corresponds to CWE‑79 (Cross‑Site Scripting).

The issue affects Copyparty version 9001:copyparty prior to 1.20.12. All installations that have both read and write permissions for an attacker on a directory are vulnerable. The product is listed under cpe:2.3:a:9001:copyparty.

The CVSS base score is 3.7, categorising the flaw as Low severity, and the EPSS score is less than 1%, indicating a low likelihood of exploitation in the wild. It is not present in the CISA KEV catalog. Exploitation requires the attacker to have write access to create .prologue.html and the victim to click a specific crafted link served by the same domain. While SameSite=Strict cookies reduce the risk, the attack is still feasible if the user interacts with the malicious link. Overall risk is moderate for environments with permissive write access, but low for strongly isolated configurations.