CVE-2026-30974 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

Copyparty is a portable file server. Prior to v1.20.11., the nohtml config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did…
Medium CVSS: 4.6

CVE-2026-30974

Copyparty is a portable file server. Prior to v1.20.11., the nohtml config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG images. A user with write-permission could upload an SVG containing embedded JavaScript, which would execute in the context of whichever user opens it. This has been fixed in v1.20.11.
Vendor
9001
Product
Copyparty
CWE
CWE-79
Yayın Tarihi
2026-03-10 18:18:56
Güncelleme
2026-03-13 20:14:44
Source Identifier
security-advisories@github.com
KEV Date Added
-

Kategoriler

CWE-79 Copyparty MEDIUM 9001 2026

Referanslar

https://github.com/9001/copyparty/commit/1c9f894e149b6be3cc7de81efc93a4ce4766e0e5 https://github.com/9001/copyparty/releases/tag/v1.20.11 https://github.com/9001/copyparty/security/advisories/GHSA-m6hv-x64c-27mm