{"id":"CVE-2026-30974","aliases":["GHSA-m6hv-x64c-27mm","PYSEC-2026-2137"],"title":"copyparty: volflag `nohtml` did not block javascript in svg files","summary":"copyparty: volflag `nohtml` did not block javascript in svg files","severity":"medium","cvss":4.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","vendor":"copyparty","product":"copyparty","ecosystem":"pip","affected":["copyparty < 1.20.11"],"patched":["copyparty 1.20.11"],"published":"2026-03-10","updated":"2026-07-13","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-m6hv-x64c-27mm","references":[{"url":"https://github.com/9001/copyparty/security/advisories/GHSA-m6hv-x64c-27mm"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30974"},{"url":"https://github.com/9001/copyparty/commit/1c9f894e149b6be3cc7de81efc93a4ce4766e0e5"},{"url":"https://github.com/9001/copyparty"},{"url":"https://github.com/9001/copyparty/releases/tag/v1.20.11"}],"tags":["osv","pip"],"epss":0.00323,"epssPercentile":0.25566,"ingestedAt":"2026-07-13T18:58:00.382Z","slug":"CVE-2026-30974","body":"## Overview\n\n### Summary\nThe `nohtml` config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG images.\n\n### Details\nA user with write-permission could upload an SVG containing embedded JavaScript, which would execute in the context of whichever user opens it.\n\nThis in itself is not a vulnerability; it is intended behavior according to [the SVG spec](https://www.w3.org/TR/SVG11/script.html). The vulnerability is that the `nohtml` volflag, when enabled, did not prevent this.\n\n`nohtml`, intended for use on volumes which contains untrusted files, would correctly prevent execution of javascript in HTML files, but did not consider SVG images. This has been fixed in v1.20.11.\n\n### Impact\nThe malicious JavaScript could move or delete existing files on the server, or upload new files, using the account of the person who opens the SVG.\n\n## Affected packages\n\n- `copyparty < 1.20.11`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `copyparty 1.20.11`","depth":"sunlit","depthScore":25,"depthScoreParts":{"impact":25.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}