Joplin Server CVE-2026-59814

Requires a running Joplin Server instance prior to 3.7.7 and a low-privileged authenticated account able to upload resources and create shares (PR:L). The attacker must publish a resource attachment with an empty title and an attacker-controlled MIME of image/svg+xml (the empty title is what causes Content-Disposition to be omitted, letting the SVG render inline). A victim must open the resulting public share link (UI:R). Full application-origin impact - reading administrative data and anti-CSRF tokens - occurs under the DEFAULT configuration where user content shares the Joplin Server application origin; instances configured with a separate USER_CONTENT_BASE_URL still execute the script but confine it to the user-content origin, and the highest-value outcome requires the victim to be an authenticated (ideally administrative) user.

This is a genuine, well-substantiated stored XSS (CWE-79) in Joplin Server prior to 3.7.7, confirmed by the vendor advisory (GHSA-mx98-7h4g-6gmh), the fixing PR #15787, and the commit 920cd8f4 whose regression tests reproduce the exact behavior. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N (7.6) is well-calibrated: network attack vector, low complexity, only low privileges required (any user who can publish a share), user interaction required (victim must open the share), and a scope change because the injected script executes in the Joplin Server application origin against a different user's session. The C:H rating is justified because the script can read same-origin administrative data and anti-CSRF tokens; I:L reflects the ability to perform limited actions with the victim's session. No EPSS score, no CISA KEV listing, and no public exploit code are present in the supplied data, so exploitation status is 'no public exploit identified at time of analysis' - the high CVSS is driven by impact and scope, not by observed exploitation. Realistically this is a moderate priority for organizations running self-hosted Joplin Server: exploitation is gated behind holding a low-privileged account, a victim opening a specific public share, and (for full application-origin impact) the default configuration where user content shares the app origin. Installations using a separate USER_CONTENT_BASE_URL origin still execute the script but confine it to the user-content origin, materially reducing impact - a mitigating factor worth verifying per deployment. No conflicting signals were found between the CVSS vector and the description; both consistently indicate authenticated remote injection with victim interaction.

A low-privileged user of a Joplin Server instance uploads an image/svg+xml attachment with an empty title containing an embedded <script>, references it from a note, and publishes it as a public share. When a victim - ideally an authenticated administrator - opens the share link, the server serves the SVG inline with the attacker-controlled MIME and no Content-Disposition, so the script runs in the Joplin Server application origin and can read admin data and anti-CSRF tokens and act with the victim's session. No public exploit code is identified, but the fixing PR's tests demonstrate the payload precisely.