Copyparty is a portable file server that allows users to upload files. In versions prior to 1.20.11, the configuration option intended to block JavaScript in uploaded HTML files—the nohtml flag—did not apply to SVG images. An attacker with write permission can embed JavaScript inside an SVG file; when another user opens that file in a browser, the script runs in the context of that user’s browser. This enables cross‑site scripting that can steal session cookies, credentials, or execute further client‑side attacks.

The vulnerability affects the Copyparty product from vendor 9001. Any deployment running a version earlier than 1.20.11 is susceptible. Users should verify their installed version and apply the update if below the mentioned threshold.

The CVSS score of 4.6 denotes moderate severity, while the EPSS score of less than 1 % indicates a low likelihood of exploitation in the wild. Copyparty is not listed in the CISA KEV catalog. The attack requires an authenticated user with write permissions to upload a crafted SVG; once uploaded, the malicious code executes in the victim’s browser, compromising client‑side confidentiality and integrity but not the server itself.