CVE-2026-59814 Details

A stored cross-site scripting vulnerability has been identified in Joplin Server versions prior to 3.7.7. The issue arises in the `GET /shares/:id?resource_id=` route, where the server serves resources with an attacker-controlled MIME type and omits the `Content-Disposition` header when the resource title is empty. A low-privileged user can exploit this by uploading an image/svg+xml attachment with an empty title, causing the embedded script to execute when a victim opens the public share. This exploitation accesses same-origin data and, if the victim is authenticated, performs actions using the victim's session, such as reading administrative data and anti-CSRF tokens. The vulnerability also affects installations with a separate `USER_CONTENT_BASE_URL`, executing the script on that origin instead.

Users can update to Joplin Server version 3.7.7 or later, where this vulnerability has been fixed.