CVE-2026-30974
Copyparty volflag `nohtml` did not block javascript in svg files
Copyparty is a portable file server. Prior to v1.20.11., the nohtml config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG images. A user with write-permission could upload an SVG containing embedded JavaScript, which would execute in the context of whichever user opens it. This has been fixed in v1.20.11.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Copyparty volflag `nohtml` did not block javascript in svg files
Copyparty is a portable file server. Prior to v1.20.11., the nohtml config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG images. A user with write-permission could upload an SVG containing embedded JavaScript, which would execute in the context of whichever user opens it. This has been fixed in v1.20.11.
- Record
CVE-2026-30974- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2026-10711
Copyparty is a portable file server. Prior to v1.20.11., the nohtml config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG images. A user with write-permission could upload an SVG containing embedded JavaScript, which would execute in the context of whichever user opens it. This has been fixed in v1.20.11.
- Record
EUVD-2026-10711- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-m6hv-x64c-27mm
copyparty: volflag `nohtml` did not block javascript in svg files
Summary
The nohtml config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG images.
Details
A user with write-permission could upload an SVG containing embedded JavaScript, which would execute in the context of whichever user opens it.
This in itself is not a vulnerability; it is intended behavior according to the SVG spec. The vulnerability is that the nohtml volflag, when enabled, did not prevent this.
nohtml, intended for use on volumes which contains untrusted files, would correctly prevent execution of javascript in HTML files, but did not consider SVG images. This has been fixed in v1.20.11.
Impact
The malicious JavaScript could move or delete existing files on the server, or upload new files, using the account of the person who opens the SVG.
- Record
GHSA-m6hv-x64c-27mm- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Copyparty is a portable file server. Prior to v1.20.11., the nohtml config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG images. A user with write-permission could upload an SVG containing embedded JavaScript, which would execute in the context of whichever user opens it. This has been fixed in v1.20.11.
- Record
CVE-2026-30974- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Copyparty volflag `nohtml` did not block javascript in svg files
Copyparty is a portable file server. Prior to v1.20.11., the nohtml config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG images. A user with write-permission could upload an SVG containing embedded JavaScript, which would execute in the context of whichever user opens it. This has been fixed in v1.20.11.
- Record
CVE-2026-30974- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-m6hv-x64c-27mm
copyparty: volflag `nohtml` did not block javascript in svg files
Summary
The nohtml config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG images.
Details
A user with write-permission could upload an SVG containing embedded JavaScript, which would execute in the context of whichever user opens it.
This in itself is not a vulnerability; it is intended behavior according to the SVG spec. The vulnerability is that the nohtml volflag, when enabled, did not prevent this.
nohtml, intended for use on volumes which contains untrusted files, would correctly prevent execution of javascript in HTML files, but did not consider SVG images. This has been fixed in v1.20.11.
Impact
The malicious JavaScript could move or delete existing files on the server, or upload new files, using the account of the person who opens the SVG.
- Record
GHSA-m6hv-x64c-27mm- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVPYSEC-2026-2137
Copyparty is a portable file server. Prior to v1.20.11., the nohtml config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG images. A user with write-permission could upload an SVG containing embedded JavaScript, which would execute in the context of whichever user opens it. This has been fixed in v1.20.11.
- Record
PYSEC-2026-2137- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
copypartyPyPI |
through 1.20.10 | 1.20.11 |
copypartyPyPI |
before 1.20.11, plus listed versions 0.10.00.10.10.10.100.10.110.10.12 Show 45 moreShow less0.10.130.10.140.10.150.10.160.10.170.10.180.10.190.10.20.10.200.10.210.10.220.10.30.10.40.10.50.10.60.10.70.10.80.10.90.11.00.11.10.11.100.11.110.11.120.11.130.11.140.11.150.11.160.11.170.11.180.11.190.11.200.11.210.11.220.11.230.11.240.11.260.11.270.11.280.11.290.11.300.11.310.11.320.11.330.11.340.11.35 |
1.20.11 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-30974 is a medium vulnerability (CVSS 4.6) in 9001 Copyparty, published March 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 32nd percentile. Fixed in copyparty 1.20.11.
References
github.com/9001/copyparty/security/advisories/GHSA-m6hv-x64c-27mm
nvd.nist.gov/vuln/detail/CVE-2026-30974
Left out here: 317 versions. The JSON record has them.