Copyparty is a portable file server. Prior to v1.20.11., the nohtml config option, intended to prevent execution of JavaScript in user-uploaded HTML files, did not apply to SVG images. A user with write-permission could upload an SVG containing embedded JavaScript, which would execute in the context of whichever user opens it. This has been fixed in v1.20.11.
oryginał ENCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N9001 Copyparty
APP9001< 1.20.11
Powiązane podatności
Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code...
Copyparty is a portable file server. Versions prior to 1.18.9, the filter parameter for the "Recent Uploads" p...
Copyparty is a portable file server. Versions prior to 1.8.2 are subject to a path traversal vulnerability det...
Copyparty is a portable file server. In versions prior to 1.20.9, an XSS allows for reflected cross-site scrip...
Copyparty is a portable file server. In versions prior to 1.19.8, there was a missing permission-check in the ...