Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-59814— Joplin: Stored XSS via inline-served note attachment on published shares

Quick assessment

Affected
laurent22 joplin
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's GET /shares/:id?resource_id= route serves a resource with the attacker-controlled mime value and omits Content-Disposition

CVSS 7.6 · High EPSS 0.25% · P17

Affected Version Matrix 1

VendorProduct Version RangeStatus
laurent22 joplin < 3.7.7 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-59814

Vulnerability Information

Shenlong is analyzing...

Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Joplin: Stored XSS via inline-served note attachment on published shares
Source: CVE Program / CVE List V5
Vulnerability Description
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's GET /shares/:id?resource_id= route serves a resource with the attacker-controlled mime value and omits Content-Disposition when the resource title is empty. A low-privileged user can publish an empty-title image/svg+xml attachment whose script executes when a victim opens the public share. By default, user content shares the Joplin Server application origin, allowing the script to access same-origin data and, when the victim is authenticated, perform actions with the victim's session, including reading administrative data and anti-CSRF tokens. Installations that configure USER_CONTENT_BASE_URL to a separate origin still execute the script, but on that separate user-content origin rather than the application origin. This issue is fixed in version 3.7.7.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
laurent22 joplin < 3.7.7 -

II. Public POCs for CVE-2026-59814

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-59814

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-59814 (2)

Other References for CVE-2026-59814 (1)

Same Patch Batch · laurent22 · 2026-09-21 · 11 CVEs total

CVE-2026-46649 9.1 CRITICAL Joplin: SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable v
CVE-2026-55105 7.7 HIGH Joplin: Fountain embeds allow arbitrary script execution in published notes and the note v
CVE-2026-55210 7.4 HIGH Joplin: SAML SSO account takeover via email-based account linking (missing is_external che
CVE-2026-49450 7.1 HIGH Joplin desktop Windows auto-updater accepts signed installer from any publisher because ap
CVE-2026-49453 7.0 HIGH Joplin: Path traversal in resource sync — silent arbitrary file write outside the resource
CVE-2026-55179 6.5 MEDIUM Joplin: Logic error in Joplin Server allows a signed-in user to read any note from its int
CVE-2026-46650 4.4 MEDIUM Joplin: Stored XSS in public share viewer via javascript: URL bypass in isAcceptedUrl
CVE-2026-59816 4.3 MEDIUM Joplin: Path traversal in transcribe proxy endpoint via URL-encoded slash
CVE-2026-59815 4.3 MEDIUM Joplin: Pending share recipients can write items into shared folders before accepting invi
CVE-2026-49449 2.5 LOW Joplin: KaTeX `trust:true` enables URL-allowlist bypass leading to NTLMv2 credential theft

IV. Related Vulnerabilities

Same product: joplin
Same vendor: laurent22
Same weakness: CWE-79

V. Comments for CVE-2026-59814

No comments yet

Leave a comment