CVE-2026-59814

Received Received - Intake

Stored XSS in Joplin Server via Malicious SVG Attachment

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's GET /shares/:id?resource_id= route serves a resource with the attacker-controlled mime value and omits Content-Disposition when the resource title is empty. A low-privileged user can publish an empty-title image/svg+xml attachment whose script executes when a victim opens the public share. By default, user content shares the Joplin Server application origin, allowing the script to access same-origin data and, when the victim is authenticated, perform actions with the victim's session, including reading administrative data and anti-CSRF tokens. Installations that configure USER_CONTENT_BASE_URL to a separate origin still execute the script, but on that separate user-content origin rather than the application origin. This issue is fixed in version 3.7.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-09-21

Generated

2026-09-22

AI Q&A

2026-09-22

EPSS Evaluated

N/A

NVD

CVE-2026-59814

Affected Vendors & Products

Vendor	Product	Version / Range
joplin	joplin_server	3.7.7

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

Joplin Server before 3.7.7 has a flaw in the GET /shares/:id?resource_id= endpoint. When a resource title is empty, the server serves the resource with a user-controlled mime type and omits the Content-Disposition header. This allows an attacker to upload an SVG image with malicious script content. When a victim opens a public share containing this attachment, the script executes in the context of the Joplin Server application origin by default.

Detection Guidance

Check if your Joplin Server version is below 3.7.7. Inspect public shares for attachments with empty titles and SVG content. Look for unexpected script execution in shared resources.

Impact Analysis

If you open a shared note containing this malicious SVG, the script can access sensitive data from the same origin, including administrative information and anti-CSRF tokens. If you are authenticated, the script can perform actions on your behalf, such as reading or modifying data within your session. Even if USER_CONTENT_BASE_URL is set to a separate origin, the script still executes but is confined to that user-content origin.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR principles of data protection and user consent. For HIPAA, it may expose protected health information to unauthorized parties, breaching confidentiality requirements. Organizations using Joplin Server must ensure timely updates to mitigate risks of non-compliance and potential data breaches.

Mitigation Strategies

Upgrade Joplin Server to version 3.7.7 or later immediately. Review and remove any suspicious public shares. Configure USER_CONTENT_BASE_URL to a separate origin if not already set.

Hi! I’m here to help you understand CVE-2026-59814. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70