Most recent entries from all

CVE-2026-30974 — Copyparty volflag `nohtml` did not block javascript in svg files

2026-10-02T09:39:05.114442+00:00

Affected: 9001 copyparty

Copyparty is a portable file server. Prior to v1.20.11., the nohtml config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG images. A user with write-permission could upload an SVG containing embedded JavaScript, which would execute in the context of whichever user opens it. This has been fixed in v1.20.11.

GHSA-m6hv-x64c-27mm — copyparty: volflag `nohtml` did not block javascript in svg files

2026-10-02T09:39:05.114514+00:00

Affected: PyPI: copyparty

### Summary The `nohtml` config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG images.

### Details A user with write-permission could upload an SVG containing embedded JavaScript, which would execute in the context of whichever user opens it.

This in itself is not a vulnerability; it is intended behavior according to [the SVG spec](https://www.w3.org/TR/SVG11/script.html). The vulnerability is that the `nohtml` volflag, when enabled, did not prevent this.

`nohtml`, intended for use on volumes which contains untrusted files, would correctly prevent execution of javascript in HTML files, but did not consider SVG images. This has been fixed in v1.20.11.

### Impact The malicious JavaScript could move or delete existing files on the server, or upload new files, using the account of the person who opens the SVG.

PYSEC-2026-2137

2026-10-02T09:39:05.114552+00:00

Affected: PyPI: copyparty