CVE-2026-30974: copyparty: volflag `nohtml` did not block javascript in svg files

March 10, 2026

The nohtml config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG images.

References

github.com/9001/copyparty
github.com/9001/copyparty/commit/1c9f894e149b6be3cc7de81efc93a4ce4766e0e5
github.com/9001/copyparty/releases/tag/v1.20.11
github.com/9001/copyparty/security/advisories/GHSA-m6hv-x64c-27mm
github.com/advisories/GHSA-m6hv-x64c-27mm
nvd.nist.gov/vuln/detail/CVE-2026-30974

Code Behaviors & Features

Detect and mitigate CVE-2026-30974 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →