CVE-2026-59814

Description

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's GET /shares/:id?resource_id= route serves a resource with the attacker-controlled mime value and omits Content-Disposition when the resource title is empty. A low-privileged user can publish an empty-title image/svg+xml attachment whose script executes when a victim opens the public share. By default, user content shares the Joplin Server application origin, allowing the script to access same-origin data and, when the victim is authenticated, perform actions with the victim's session, including reading administrative data and anti-CSRF tokens. Installations that configure USER_CONTENT_BASE_URL to a separate origin still execute the script, but on that separate user-content origin rather than the application origin. This issue is fixed in version 3.7.7.

Overview

State: PUBLISHED
Assigner (CNA): GitHub_M
CVSS severity: HIGH
CVSS score: 7.6 / 10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
Effective score: 7.6 / 10 HIGH source: CNA overview
CWE(s): CWE-79
Reserved: 2026-07-07
Published: 2026-09-21 21:13 UTC
Last updated: 2026-09-21 21:13 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/59xxx/CVE-2026-59814.json
Linked Threat: CVE-2026-59814 — Joplin: Stored XSS via inline-served note attachment on published shares

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-09-21 22:16:57 UTC
NVD last modified: 2026-09-21 22:16:57 UTC
NVD CVSS v3.1: 7.6 / 10 HIGH source: security-advisories@github.com
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
Exploitability subscore: 2.3 / 10
Impact subscore: 4.7 / 10

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-84174
Assigner: GitHub_M
Published: Sep 21, 2026, 9:13:17 PM
Updated: Sep 22, 2026, 1:29:52 PM
EUVD base score (CVSS 3.1): 7.6 / 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
EUVD-reported EPSS: 0.0000
Vendors: laurent22
Products: joplin (< 3.7.7)

ENISA description: Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's GET /shares/:id?resource_id= route serves a resource with the attacker-controlled mime value and omits Content-Disposition when the resource title is empty. A low-privileged user can publish an empty-title image/svg+xml attachment whose script executes when a victim opens the public share. By default, user content shares the Joplin Server application origin, allowing the script to access same-origin data and, when the victim is authenticated, perform actions with the victim's session, including reading administrative data and anti-CSRF tokens. Installations that configure USER_CONTENT_BASE_URL to a separate origin still execute the script, but on that separate user-content origin rather than the application origin. This issue is fixed in version 3.7.7.

EUVD references (3)

Affected products (1)

Vendor	Product	Versions	Platforms
laurent22	joplin	`< 3.7.7` (affected)	—

Vendor references (3)

References embedded in the original CVE record by the assigning CNA.

https://github.com/laurent22/joplin/security/advisories/GHSA-mx98-7h4g-6gmh x_refsource_CONFIRM
https://github.com/laurent22/joplin/pull/15787 x_refsource_MISC
https://github.com/laurent22/joplin/commit/920cd8f463bf9bbce9daa07581676123007118e5 x_refsource_MISC

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (3)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://github.com/laurent22/joplin/commit/920cd8f463bf9bbce9daa07581676123007118e5 security-advisories@github.com
https://github.com/laurent22/joplin/pull/15787 security-advisories@github.com
https://github.com/laurent22/joplin/security/advisories/GHSA-mx98-7h4g-6gmh security-advisories@github.com

Remediations (10)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

CVE-2026-69414 ShieldBreak Zero-Day: No Patch, and CISA BOD 26-04 Gives ...

web:blog.qualys.com

Executive Summary ShieldBreak ( CVE - 2026 -69414) is a zero-day elevation-of-privilege vulnerability in the Microsoft Malware Protection Engine used by Microsoft Defender, allowing a low-privilege local attacker to escalate to SYSTEM. A public PoC was released on August 12, 2026 , and Microsoft assigned the CVE on August 14, and no patch is available yet. Qualys VMDR provides detection across ...

2026-09-22 16:47 UTC
Pennsylvania Access To Criminal History - Home - pa

web:epatch.pa.gov

Why does PATCH exist? Its purpose is to better enable the public to obtain criminal history record checks. The repository was created and is maintained in accordance with Pennsylvania's Criminal History Information Act contained in Chapter 91 of Title 18, Crimes Code. This Act also directs the Pennsylvania State Police (PSP) to disseminate criminal history data to criminal justice agencies ...

2026-09-22 16:47 UTC
Across Connecticut News, Breaking News in Across Connecticut - Patch

web:patch.com

Across Connecticut Latest Headlines: Person, Dog Killed In House Fire: Officials: CT News; DEEP: As Bears Get Fat, There's a Bigger Chance For Human Conflict ; Why Your iPhone Battery Dies So Fast ...

2026-09-22 16:47 UTC
Wallingford News, Breaking News in Wallingford, CT - Patch

web:patch.com

Wallingford Latest Headlines: Wallingford Resident Wins Big Lottery Prize; 🌱 Patch AM: Wallingford Resident Wins Big Lottery Prize; Why Your iPhone Battery Dies So Fast — And How To Make It ...

2026-09-22 16:47 UTC
August 11, 2026—Hotpatch KB5120994 (OS Builds 26200.9106 and 26100.9106 ...

web:support.microsoft.com

This Hotpatch update for Windows 11, version 25H2 and 24H2 (KB5120994) includes security improvements. To learn more about differences between security updates, optional non-security preview updates, out-of-band (OOB) updates, and continuous innovation, see Windows monthly updates explained. For information on Windows update terminology, see the different types of Windows software updates. To ...

2026-09-22 16:47 UTC
Known Exploited Vulnerabilities Catalog - CISA

web:www.cisa.gov

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework. Learn more about ...

2026-09-22 16:47 UTC
Patch Instructions - Kagura Games

web:www.kaguragames.com

3. Click "Next" 2 more times. After the patch is finished installing, your game should now be patched.

2026-09-22 16:47 UTC
Patches - Kagura Games

web:www.kaguragames.com

Discover Kagura Games' patches to enhance your gaming experience with new features and updates for your favorite games.

2026-09-22 16:47 UTC
Microsoft Releases Record September Patch Tuesday Fixing 900 ... - LinkedIn

web:www.linkedin.com

Microsoft has released its largest Patch Tuesday security update to date, addressing over 900 vulnerabilities across Windows and other products, including two privilege-escalation flaws that ...

2026-09-22 16:47 UTC
Home - PATCH Hawaii

web:www.patchhawaii.org

PATCH provides access to registered and licensed child care, offers child care subsidies to eligible families, provides child development training and ECE scholarship opportunities, and assists those interested in starting a family child care business. PATCH is a free resource hub for families, child care professionals and communities of Hawaii.

2026-09-22 16:47 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-59814.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "joplin",
          "vendor": "laurent22",
          "versions": [
            {
              "status": "affected",
              "version": "< 3.7.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's GET /shares/:id?resource_id= route serves a resource with the attacker-controlled mime value and omits Content-Disposition when the resource title is empty. A low-privileged user can publish an empty-title image/svg+xml attachment whose script executes when a victim opens the public share. By default, user content shares the Joplin Server application origin, allowing the script to access same-origin data and, when the victim is authenticated, perform actions with the victim's session, including reading administrative data and anti-CSRF tokens. Installations that configure USER_CONTENT_BASE_URL to a separate origin still execute the script, but on that separate user-content origin rather than the application origin. This issue is fixed in version 3.7.7."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T21:13:17.395Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/laurent22/joplin/security/advisories/GHSA-mx98-7h4g-6gmh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/laurent22/joplin/security/advisories/GHSA-mx98-7h4g-6gmh"
        },
        {
          "name": "https://github.com/laurent22/joplin/pull/15787",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/laurent22/joplin/pull/15787"
        },
        {
          "name": "https://github.com/laurent22/joplin/commit/920cd8f463bf9bbce9daa07581676123007118e5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/laurent22/joplin/commit/920cd8f463bf9bbce9daa07581676123007118e5"
        }
      ],
      "source": {
        "advisory": "GHSA-mx98-7h4g-6gmh",
        "discovery": "UNKNOWN"
      },
      "title": "Joplin: Stored XSS via inline-served note attachment on published shares"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-59814",
    "datePublished": "2026-09-21T21:13:17.395Z",
    "dateReserved": "2026-07-07T15:00:50.978Z",
    "dateUpdated": "2026-09-21T21:13:17.395Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}