Summaryinfo

A vulnerability described as problematic has been identified in HedgeDoc up to 1.10.2. This affects an unknown function of the file /uploads of the component Content-Disposition Parser. Such manipulation leads to cross site scripting. This vulnerability is referenced as CVE-2025-32391. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is recommended. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in HedgeDoc up to 1.10.2. Affected by this issue is an unknown code block of the file /uploads of the component Content-Disposition Parser. The manipulation with an unknown input leads to a cross site scripting vulnerability. Using CWE to declare the problem leads to CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Impacted is integrity. CVE summarizes:

HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.3, a malicious SVG file uploaded to HedgeDoc results in the possibility of XSS when opened in a new tab instead of the editor itself. The XSS is possible by exploiting the JSONP capabilities of GitHub Gist embeddings. Only instances with the local filesystem upload backend or special configurations, where the uploads are served from the same domain as HedgeDoc, are vulnerable. This vulnerability is fixed in 1.10.3. When upgrading to HedgeDoc 1.10.3 is not possible, instance owners could add the following headers for all routes under /uploads as a first-countermeasure: Content-Disposition: attachment and Content-Security-Policy: default-src 'none'. Additionally, the external URLs in the script-src attribute of the Content-Security-Policy header should be removed.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2025-32391 since 04/06/2025. The exploitation is known to be difficult. The attack may be launched remotely. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.007.

Upgrading to version 1.10.3 eliminates this vulnerability. Applying the patch 0636b5c20b7097afccfa6641830352ad068ef964 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• HedgeDoc

Version

• 1.10.0
• 1.10.1
• 1.10.2

License

• open-source

Website

• Product: https://github.com/hedgedoc/hedgedoc/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion