https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T19:36:07.331601+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-30974 CVE-2026-30974 — Copyparty volflag `nohtml` did not block javascript in svg files 2026-10-07T19:36:07.353878+00:00

Affected: 9001 copyparty

Copyparty is a portable file server. Prior to v1.20.11., the nohtml config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG images. A user with write-permission could upload an SVG containing embedded JavaScript, which would execute in the context of whichever user opens it. This has been fixed in v1.20.11.