PT-2026-24194 · Copyparty · Copyparty

Varshanknaik · CVE-2026-30974 · Published 2026-03-10 · Updated 2026-03-16

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Copyparty versions prior to 1.20.11

Description Copyparty’s nohtml configuration option, designed to block JavaScript execution in uploaded HTML files, did not extend to SVG images. A user with write access could upload an SVG file containing embedded JavaScript. When opened by another user, this JavaScript would execute within their context. This could allow a malicious actor to move, delete, or upload files using the account of the user opening the SVG. The nohtml option correctly prevented JavaScript execution in HTML files but failed to account for SVG images.

Recommendations Update to version 1.20.11 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-30974

GHSA-M6HV-X64C-27MM

PYSEC-2026-2137

Affected Products

Copyparty

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30974.json · Exploit
• https://github.com/9001/copyparty/commit/1c9f894e149b6be3cc7de81efc93a4ce4766e0e5 · Patch
• https://github.com/9001/copyparty/security/advisories/GHSA-m6hv-x64c-27mm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-30974 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m6hv-x64c-27mm · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-2137 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30974 · Security Note
• https://github.com/9001/copyparty/releases/tag/v1.20.11 · Note
• https://github.com/9001/copyparty · Note
• https://reddit.com/r/VulnMatter/comments/1rpx2ut/resumen_diario_de_vulnerabilidades_10032026 · Reddit Post
• https://twitter.com/CVEnew/status/2033361100368941124 · Twitter Post