CVE-2026-30974

MEDIUM

4.6

Descricao

Copyparty is a portable file server. Prior to v1.20.11., the nohtml config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG images. A user with write-permission could upload an SVG containing embedded JavaScript, which would execute in the context of whichever user opens it. This has been fixed in v1.20.11.

Detalhes CVE

Pontuacao CVSS v3.14.6

SeveridadeMEDIUM

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosLOW

Interacao do usuarioREQUIRED

Publicado3/10/2026

Ultima modificacao3/13/2026

Fontenvd

Avistamentos honeypot0

Produtos afetados

9001:copyparty

Fraquezas (CWE)

CWE-79

Referencias

https://github.com/9001/copyparty/commit/1c9f894e149b6be3cc7de81efc93a4ce4766e0e5(security-advisories@github.com)

https://github.com/9001/copyparty/releases/tag/v1.20.11(security-advisories@github.com)

https://github.com/9001/copyparty/security/advisories/GHSA-m6hv-x64c-27mm(security-advisories@github.com)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.