CVE-2026-30974 json
Copyparty volflag `nohtml` did not block javascript in svg files
published 2026-03-10 8 mo ago modified 2026-07-13 3 mo ago also EUVD-2026-10711 , GHSA-m6hv-x64c-27mm , PYSEC-2026-2137
- cvss
- 4.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 32%
- public exploits
- 0
- none known
Summary
Copyparty is a portable file server. Prior to v1.20.11., the nohtml config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG images. A user with write-permission could upload an SVG containing embedded JavaScript, which would execute in the context of whichever user opens it. This has been fixed in v1.20.11.
Patch / fix
- pypi copyparty 1.20.11
- 9001 copyparty 1.20.11
- copyparty_project copyparty 1.20.11
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 7 mo ago
Exploit prediction
0.39% chance of exploitation in the next 30 days, higher than 32% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N |
| GitHub | 3.1 | 4.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| OSV | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | copyparty | <1.20.11 |
1.20.11 |
Affected products
- 9001 copyparty
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/9001/copyparty/commit/1c9f894e149b6be3cc7de81efc93a4ce4766e0e5
web, patch
-
github.com
/9001/copyparty/security/advisories/GHSA-m6hv-x64c-27mm
web, vendor-advisory, advisory
-
github.com
/9001/copyparty/releases/tag/v1.20.11
web, product, release-notes, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-30974
advisory
-
github.com
/9001/copyparty
package
Sources
- CVE List CVE-2026-30974
- GitHub Advisory GHSA-m6hv-x64c-27mm
- NVD CVE-2026-30974
- OSV PYSEC-2026-2137
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.