PYSEC-2026-2137

vendorUSosv

view advisory published 2026-03-10Licence: CC-BY-4.0

Copyparty is a portable file server. Prior to v1.20.11., the nohtml config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG images. A user with write-permission could upload an SVG containing embedded JavaScript, which would execute in the context of whichever user opens it. This has been fixed in v1.20.11.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-30974US	medium5.4	0.34% (28th)	—	2026-03-10
Copyparty is a portable file server. Prior to v1.20.11., the nohtml config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG ima…

references

External citations — patches, advisories, analysis.

https://github.com/9001/copyparty/commit/1c9f894e149b6be3cc7de81efc93a4ce4766e0e5FIX
https://github.com/9001/copyparty/releases/tag/v1.20.11ADVISORY
https://github.com/9001/copyparty/security/advisories/GHSA-m6hv-x64c-27mmADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan