CVE-2026-30974

Copyparty is a portable file server. Prior to v1.20.11., the nohtml config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG images. A user with write-permission could upload an SVG containing embedded JavaScript, which would execute in the context of whichever user opens it. This has been fixed in v1.20.11.

CVSS v3 4.6 MEDIUM

4.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.1 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/9001/copyparty/commit/1c9f894e149b6be3cc7de81efc93a4ce4766e0e5	Patch
https://github.com/9001/copyparty/releases/tag/v1.20.11	Product Release Notes
https://github.com/9001/copyparty/security/advisories/GHSA-m6hv-x64c-27mm	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:9001:copyparty:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-03-10 18:18

Updated : 2026-03-13 20:14

NVD link : CVE-2026-30974

Mitre link : CVE-2026-30974

CVE.ORG link : CVE-2026-30974

JSON object : View

Products Affected

9001

copyparty

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-30974", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2026-03-10T18:18:56.220", "references": [{"url": "https://github.com/9001/copyparty/commit/1c9f894e149b6be3cc7de81efc93a4ce4766e0e5", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/9001/copyparty/releases/tag/v1.20.11", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/9001/copyparty/security/advisories/GHSA-m6hv-x64c-27mm", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Copyparty is a portable file server. Prior to v1.20.11., the nohtml config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG images. A user with write-permission could upload an SVG containing embedded JavaScript, which would execute in the context of whichever user opens it. This has been fixed in v1.20.11."}, {"lang": "es", "value": "Copyparty es un servidor de archivos port\u00e1til. Antes de la v1.20.11., la opci\u00f3n de configuraci\u00f3n nohtml, destinada a evitar la ejecuci\u00f3n de JavaScript en archivos HTML subidos por el usuario, no se aplicaba a las im\u00e1genes SVG. Un usuario con permiso de escritura pod\u00eda subir un SVG que conten\u00eda JavaScript incrustado, el cual se ejecutar\u00eda en el contexto de cualquier usuario que lo abriera. Esto ha sido corregido en la v1.20.11."}], "lastModified": "2026-03-13T20:14:44.720", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:9001:copyparty:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "430C3EDB-42FA-41FD-B9FE-739C47155409", "versionEndExcluding": "1.20.11"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}