CVE-2026-30974

MEDIUM

4.6

Descripcion

Copyparty is a portable file server. Prior to v1.20.11., the nohtml config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG images. A user with write-permission could upload an SVG containing embedded JavaScript, which would execute in the context of whichever user opens it. This has been fixed in v1.20.11.

Detalles CVE

Puntuacion CVSS v3.14.6

SeveridadMEDIUM

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosLOW

Interaccion usuarioREQUIRED

Publicado3/10/2026

Ultima modificacion3/13/2026

Fuentenvd

Avistamientos honeypot0

Productos afectados

9001:copyparty

Debilidades (CWE)

CWE-79

Referencias

https://github.com/9001/copyparty/commit/1c9f894e149b6be3cc7de81efc93a4ce4766e0e5(security-advisories@github.com)

https://github.com/9001/copyparty/releases/tag/v1.20.11(security-advisories@github.com)

https://github.com/9001/copyparty/security/advisories/GHSA-m6hv-x64c-27mm(security-advisories@github.com)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.