https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 09:39:05 +0000 https://db.gcve.eu/vuln/cve-2026-30974 <p><strong>Affected:</strong> 9001 copyparty</p> <p>Copyparty is a portable file server. Prior to v1.20.11., the nohtml config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG images. A user with write-permission could upload an SVG containing embedded JavaScript, which would execute in the context of whichever user opens it. This has been fixed in v1.20.11.</p> <p><strong>Affected:</strong> 9001 copyparty</p> <p>Copyparty is a portable file server. Prior to v1.20.11., the nohtml config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG images. A user with write-permission could upload an SVG containing embedded JavaScript, which would execute in the context of whichever user opens it. This has been fixed in v1.20.11.</p> https://db.gcve.eu/vuln/cve-2026-30974 https://db.gcve.eu/vuln/ghsa-m6hv-x64c-27mm <p><strong>Affected:</strong> PyPI: copyparty</p> <p>### Summary The `nohtml` config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG images.</p> <p>### Details A user with write-permission could upload an SVG containing embedded JavaScript, which would execute in the context of whichever user opens it.</p> <p>This in itself is not a vulnerability; it is intended behavior according to [the SVG spec](https://www.w3.org/TR/SVG11/script.html). The vulnerability is that the `nohtml` volflag, when enabled, did not prevent this.</p> <p>`nohtml`, intended for use on volumes which contains untrusted files, would correctly prevent execution of javascript in HTML files, but did not consider SVG images. This has been fixed in v1.20.11.</p> <p>### Impact The malicious JavaScript could move or delete existing files on the server, or upload new files, using the account of the person who opens the SVG.</p> <p><strong>Affected:</strong> PyPI: copyparty</p> <p>### Summary The `nohtml` config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG images.</p> <p>### Details A user with write-permission could upload an SVG containing embedded JavaScript, which would execute in the context of whichever user opens it.</p> <p>This in itself is not a vulnerability; it is intended behavior according to [the SVG spec](https://www.w3.org/TR/SVG11/script.html). The vulnerability is that the `nohtml` volflag, when enabled, did not prevent this.</p> <p>`nohtml`, intended for use on volumes which contains untrusted files, would correctly prevent execution of javascript in HTML files, but did not consider SVG images. This has been fixed in v1.20.11.</p> <p>### Impact The malicious JavaScript could move or delete existing files on the server, or upload new files, using the account of the person who opens the SVG.</p> https://db.gcve.eu/vuln/ghsa-m6hv-x64c-27mm https://db.gcve.eu/vuln/pysec-2026-2137 <p><strong>Affected:</strong> PyPI: copyparty</p> <p>Copyparty is a portable file server. Prior to v1.20.11., the nohtml config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG images. A user with write-permission could upload an SVG containing embedded JavaScript, which would execute in the context of whichever user opens it. This has been fixed in v1.20.11.</p> <p><strong>Affected:</strong> PyPI: copyparty</p> <p>Copyparty is a portable file server. Prior to v1.20.11., the nohtml config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG images. A user with write-permission could upload an SVG containing embedded JavaScript, which would execute in the context of whichever user opens it. This has been fixed in v1.20.11.</p> https://db.gcve.eu/vuln/pysec-2026-2137