CVE-2026-59814 in Joplin
Summary
by MITRE • 09/22/2026
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's GET /shares/:id?resource_id= route serves a resource with the attacker-controlled mime value and omits Content-Disposition when the resource title is empty. A low-privileged user can publish an empty-title image/svg+xml attachment whose script executes when a victim opens the public share. By default, user content shares the Joplin Server application origin, allowing the script to access same-origin data and, when the victim is authenticated, perform actions with the victim's session, including reading administrative data and anti-CSRF tokens. Installations that configure USER_CONTENT_BASE_URL to a separate origin still execute the script, but on that separate user-content origin rather than the application origin. This issue is fixed in version 3.7.7.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in Joplin Server prior to version 3.7.7 represents a critical cross-site scripting flaw rooted in improper input validation and content handling within the file sharing mechanism. Specifically, the GET /shares/:id?resource_id= endpoint fails to sanitize or enforce strict constraints on the MIME type metadata associated with uploaded resources when certain conditions are met. The core technical defect occurs when an attacker uploads a resource with an empty title field; in this specific scenario, the server omits the Content-Disposition HTTP header and serves the file using the exact MIME value provided by the user during upload rather than deriving it from the actual content or enforcing a safe default. This behavior allows a low-privileged user to publish an image/svg+xml attachment that contains malicious JavaScript code instead of valid SVG markup intended for rendering as graphics.
When a victim accesses this public share, their browser interprets the resource based on the supplied MIME type and executes the embedded script within the context of the Joplin Server application origin by default. This execution environment is particularly dangerous because it grants the attacker's script access to same-origin data stored in local storage or cookies associated with the domain. If the victim user is authenticated at the time they view the shared resource, the malicious script can interact directly with the web application's API endpoints and DOM elements without restriction. The absence of proper Content-Disposition headers further exacerbates this issue by preventing browsers from treating the content as a download attachment, thereby ensuring inline execution within the browsing context rather than triggering a file save dialog that might mitigate immediate code execution in some browser configurations.
The operational impact of this vulnerability is severe, enabling full account takeover and potential privilege escalation for authenticated users. Once the script executes, it can read sensitive administrative data stored on the client side or transmitted via subsequent requests. Furthermore, because modern web applications often rely on anti-CSRF tokens to prevent cross-site request forgery attacks, a successful exploitation of this XSS flaw allows the attacker to extract these tokens from the victim's session and use them to forge authenticated requests. This capability effectively bypasses standard CSRF protections, allowing the attacker to perform actions such as modifying user settings, accessing private notes, or escalating privileges if administrative endpoints are accessible via simple API calls triggered by the script.
In installations where the USER_CONTENT_BASE_URL is configured to point to a separate origin for static file serving, the vector remains viable but shifts in scope. While the script still executes upon viewing the share, it operates within the context of that separate user-content origin rather than the main application domain. Although this separation may limit direct access to cookies and local storage belonging to the primary Joplin Server instance, it does not fully neutralize the threat if any cross-origin resource sharing policies are misconfigured or if the attacker can leverage other mechanisms to bridge the trust boundary between the content server and the application server. The risk persists because the fundamental flaw of trusting user-supplied MIME types without validation remains present regardless of the hosting configuration.
This vulnerability is classified under CWE-79, which covers Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). It also aligns with MITRE ATT&CK technique T1059.007, representing JavaScript-based execution within a web browser environment. The mitigation strategy is straightforward and has been implemented in Joplin Server version 3.7.7. Administrators must upgrade to this patched version immediately to ensure that the server correctly sanitizes MIME types or enforces strict Content-Disposition headers regardless of whether resource titles are empty. Additionally, implementing a Content Security Policy (CSP) with restrictive script-src directives can provide an additional layer of defense by preventing unauthorized scripts from executing even if they manage to bypass input validation controls. Regular security audits and penetration testing focusing on file upload mechanisms should be conducted to detect similar logic flaws in other components that handle user-generated content metadata.