4.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-30974

CVE-2026-30974: Copyparty volflag `nohtml` did not block javascript in svg files

Copyparty is a portable file server. Prior to v1.20.11., the nohtml config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG images. A user with write-permission could upload an SVG containing embedded JavaScript, which would execute in the context of whichever user opens it. This has been fixed in v1.20.11.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-30974

CVE-2026-30974:

4.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
copyparty	pip	<= 1.20.10	1.20.11

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-m6hv-x64c-27mm, was caused by an incomplete check in the copyparty file serving logic. The nohtml configuration flag was intended to prevent Cross-Site Scripting (XSS) by serving potentially dangerous files as plain text. However, the implementation only checked for 'html' in the file's MIME type, completely missing other file types that can execute JavaScript, most notably SVG images (image/svg+xml).

The analysis of the patch commit 1c9f894e149b6be3cc7de81efc93a4ce4766e0e5 reveals that the core of the vulnerability was in the HttpCli.tx_file and HttpCli.tx_zget methods within copyparty/httpcli.py. These functions are responsible for serving files to the user, either directly from the filesystem or from within a zip archive.

The patch introduces a more robust check. Instead of just looking for 'html', it now checks the file's MIME type against a pre-defined set of safe MIME types (SAFE_MIMES). If the MIME type is not in this safe set, the new safe_mime utility function is called to return a safe MIME type, either text/plain or application/octet-stream. This forces the browser to download the file or render it as text, rather than executing it, thus mitigating the XSS vulnerability.

The vulnerable functions are HttpCli.tx_file and HttpCli.tx_zget because they were the ones that would, upon request for a malicious SVG file, serve it with a content type that caused the browser to execute embedded scripts. The safe_mime function is included as a mitigation function that is now part of the execution flow when serving potentially unsafe files.

Vulnerable functions

HttpCli.tx_file

copyparty/httpcli.py

The `tx_file` function was vulnerable because it only checked if the mime type contained 'html' to prevent XSS when the `nohtml` flag was enabled. This allowed files with other mime types that can contain executable javascript, such as SVG (`image/svg+xml`), to be served and rendered by the browser. An attacker could upload a malicious SVG file, and when a user views it, the embedded javascript would execute in the user's browser context.

HttpCli.tx_zget

copyparty/httpcli.py

The `tx_zget` function, which handles serving files from within a zip archive, was vulnerable because it did not perform any check on the mime type of the file being served when the `nohtml` flag was set. This allowed a malicious SVG file within a zip archive to be served with the `image/svg+xml` mime type, leading to XSS when a user views the file from the archive.

safe_mime

copyparty/util.py

This new function was added to mitigate the vulnerability. It is called by the patched `tx_file` and `tx_zget` functions. It takes a mime type and returns a safe alternative ('text/plain' or 'application/octet-stream') if the original mime type is potentially unsafe (contains 'text/' or 'xml'). This prevents the browser from rendering potentially malicious content.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.