{"id":"CVE-2026-59814","title":"Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks","summary":"Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's GET /shares/:id?resource_id= route serves a resource with the attacker-controlled mime value and om…","severity":"high","cvss":7.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","cwe":["CWE-79"],"vendor":"laurent22","product":"joplin","affected":["joplin < 3.7.7"],"published":"2026-09-21","updated":"2026-09-23","sourceUpdated":"2026-09-23T18:30:42.573","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-59814","references":[{"url":"https://github.com/laurent22/joplin/commit/920cd8f463bf9bbce9daa07581676123007118e5","label":"security-advisories@github.com"},{"url":"https://github.com/laurent22/joplin/pull/15787","label":"security-advisories@github.com"},{"url":"https://github.com/laurent22/joplin/security/advisories/GHSA-mx98-7h4g-6gmh","label":"security-advisories@github.com"},{"url":"https://github.com/laurent22/joplin/security/advisories/GHSA-mx98-7h4g-6gmh","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"epss":0.0035,"epssPercentile":0.25878,"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-22T13:29:30.699889Z"},"ingestedAt":"2026-09-21T21:53:57.433Z","slug":"CVE-2026-59814","body":"## Overview\n\nJoplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's GET /shares/:id?resource_id= route serves a resource with the attacker-controlled mime value and omits Content-Disposition when the resource title is empty. A low-privileged user can publish an empty-title image/svg+xml attachment whose script executes when a victim opens the public share. By default, user content shares the Joplin Server application origin, allowing the script to access same-origin data and, when the victim is authenticated, perform actions with the victim's session, including reading administrative data and anti-CSRF tokens. Installations that configure USER_CONTENT_BASE_URL to a separate origin still execute the script, but on that separate user-content origin rather than the application origin. This issue is fixed in version 3.7.7.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":41.8,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":209056,"id":"CVE-2026-59814","ts":1790085894656,"field":"exploit_available","old":"false","new":"true"}]}