CVE-2026-30974: copyparty SVG JavaScript Execution Bypass via nohtml Flag
Summary
CVE-2026-30974: copyparty: volflag nohtml did not block javascript in svg files. Affects copyparty versions < 1.20.11. Fixed in 1.20.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Copyparty is an open-source file sharing application that allows users to upload and share files over the web. It is designed to handle various file types, including HTML and SVG files. The application includes configuration options to enhance security, such as the 'nohtml' flag, which is intended to prevent the execution of JavaScript in user-uploaded HTML files. However, a vulnerability was discovered where this flag did not extend its protections to SVG files, potentially exposing users to security risks.
Vulnerability Detail
The vulnerability arises from the 'nohtml' configuration option, which was meant to block JavaScript execution in HTML files but failed to do so for SVG files. This oversight allows a user with write permissions to upload an SVG file containing embedded JavaScript. When another user opens this SVG file, the JavaScript executes in their context, leading to potential malicious actions such as moving, deleting, or uploading files on the server using the permissions of the user who opened the file. This vulnerability is classified under CWE-79, indicating a failure to properly sanitize user input.
How To Fix
Latest published version: 1.20.26 as of 22 Oct 2026
pip install --upgrade "copyparty==1.20.26"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.20.11
This is the first release that contains the fix.
pip install --upgrade "copyparty==1.20.11"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid allowing SVG file uploads on volumes where the 'nohtml' flag is enabled until the package is updated. This can be done by adjusting the configuration settings to restrict SVG uploads.
Conclusion
The copyparty application has a vulnerability related to the 'nohtml' configuration flag, which fails to block JavaScript execution in SVG files. Users are advised to update to version 1.20.11 or later to mitigate this risk. Until then, consider implementing workarounds to restrict SVG uploads.
See every vulnerability recorded for copyparty →
FAQ
The vulnerability allows malicious JavaScript in SVG files to execute, potentially leading to unauthorized file manipulation or data breaches.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider disabling SVG uploads or restricting access to the affected volumes as a temporary measure.
The CVSS score of this vulnerability is 4.6, indicating a moderate severity level.
More information about copyparty can be found on its official repository or documentation pages.
References
Related vulnerabilities
Recent vulnerabilities recorded for copyparty.
