CVE-2026-30974: Copyparty volflag `nohtml` did not block javascript in svg files

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-10 · updated 2026-06-17
Weakness: CWE-79

Description

Copyparty is a portable file server. Prior to v1.20.11., the nohtml config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG images. A user with write-permission could upload an SVG containing embedded JavaScript, which would execute in the context of whichever user opens it. This has been fixed in v1.20.11.

Affected products

9001 copyparty: before 1.20.11 — fixed in 1.20.11

How to fix

Upgrade to a fixed version: 9001 copyparty 1.20.11. Check the vendor advisory for mitigations.

References

https://github.com/9001/copyparty/commit/1c9f894e149b6be3cc7de81efc93a4ce4766e0e5
https://github.com/9001/copyparty/releases/tag/v1.20.11
https://github.com/9001/copyparty/security/advisories/GHSA-m6hv-x64c-27mm

Get alerted when CVE-2026-30974 or the next vulnerability affects your stack