CVE-2026-119764 in Mythic
Summary
by MITRE • 10/30/2026
Mythic 3.2.16 through 3.4.0.61 contains a stored cross-site scripting vulnerability that allows attackers controlling target endpoint files to run JavaScript in the Mythic UI origin by planting HTML in .pdf-named files. When an operator downloads the file and clicks Preview Media, content-sniffed HTML from /direct/view renders same-origin, stealing localStorage JWTs for full GraphQL and REST access.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in Mythic versions 3.2.16 through 3.4.0.61 represents a critical stored cross-site scripting flaw that exploits the interaction between file handling mechanisms and browser content sniffing behaviors. This security defect allows an attacker who has gained control over target endpoint files to execute arbitrary JavaScript code within the context of the Mythic user interface origin. The attack vector relies on the manipulation of file naming conventions, specifically by planting HTML content inside files with a .pdf extension. When these maliciously crafted files are processed by the system, they bypass standard MIME type validation checks due to aggressive browser heuristics that prioritize filename extensions over actual content types in certain rendering contexts.
The operational impact of this vulnerability is severe because it facilitates unauthorized access to sensitive authentication tokens stored within the client-side environment. Upon downloading a compromised file and selecting the Preview Media option, the application renders the content through the /direct/view endpoint. Due to the misconfiguration or oversight regarding how HTML embedded in PDF-named files is interpreted by the browser engine, the malicious script executes with full privileges of the logged-in operator. This execution context allows the attacker to access localStorage objects where JSON Web Tokens are typically persisted for session management and API authentication purposes.
By stealing these JWTs, an adversary gains comprehensive control over both GraphQL and REST interfaces exposed by the Mythic platform. This level of access effectively compromises the integrity and confidentiality of the entire system, as the stolen tokens can be used to impersonate legitimate operators, exfiltrate sensitive data from active campaigns, modify task configurations, or escalate privileges within the infrastructure. The vulnerability aligns with CWE-79, which classifies improper neutralization of input during web page generation, specifically highlighting how stored XSS payloads are preserved and later executed in a privileged context.
From an ATT&CK perspective, this exploit maps to T1059.007, JavaScript execution via browser-based attacks, and potentially T1530, Data from Cloud Storage Object Discovery if the stolen tokens lead to further reconnaissance of cloud resources associated with the platform's backend services. The persistence mechanism is inherent in the stored nature of the payload within the file system artifacts managed by the tooling framework.
Mitigation strategies must focus on strict content type validation and output encoding practices that prevent browser-based interpretation attacks. Developers should enforce rigorous MIME type checking based on actual file signatures rather than relying solely on filename extensions, ensuring that HTML content is never rendered in a context where it can execute scripts against the application's origin. Additionally implementing Content Security Policy headers with restrictive directives for script execution sources and disabling automatic previewing of potentially dangerous file types until they are explicitly sanitized or converted to safe formats would significantly reduce the attack surface. Regular security audits focusing on how user-uploaded files are processed by frontend components are essential to prevent similar exploitation vectors in future releases.