CVE-2026-59814
HighCVSS 7.6Summary
Joplin Server prior to 3.7.7 contains a stored XSS vulnerability in the GET /shares/:id?resource_id= route, which serves a resource with the attacker-controlled mime value and omits Content-Disposition when the resource title is empty. A low-privileged user can publish an empty-title image/svg+xml attachment whose script executes when a victim opens the public share. By default, user content shares the Joplin Server application origin, allowing the script to access same-origin data and, when the victim is authenticated, perform actions with the victim's session, including reading administrative data and anti-CSRF tokens.
Risk Assessment
The risk includes session theft, unauthorized data access, and the possibility of performing administrative actions on behalf of the victim.
Recommendation
Upgrade Joplin Server to version 3.7.7 or later, which contains the fix, and consider configuring USER_CONTENT_BASE_URL to a separate origin.
Other vulnerabilities in Joplin Server
See all- CVE-2026-59815Medium
Prior to 3.7.7, Joplin Server's ItemModel.checkIfAllowed() authorizes writes to items with a share ID when any share_users row exists for the caller, without requiring ShareUserStatus.Accepted. A low-privileged authenticated user with a pending folder-share invitation can create an item under the share ID, and ShareModel.updateSharedItems3() propagates the injected content to the owner and accepted participants before the attacker accepts the invitation.
- CVE-2026-55210High
Joplin Server prior to 3.7.2 contains a vulnerability in UserModel.ssoLogin() that returns an existing account matched by an IdP-asserted email without checking the account's is_external flag. In deployments using mixed local and SAML authentication, an attacker whose IdP session can assert a local user's email can pass POST /api/saml, receive a session for that local account, and access or modify the victim's notes, files, and settings without knowing the local password.
- CVE-2026-59816Medium
Joplin Server before version 3.7.7 with TRANSCRIBE_ENABLED=true has a vulnerability in the GET/POST /api/transcribe/:id routes where the decoded id is passed directly to transcription backend URLs. An authenticated user can use URL-encoded slash and parent-directory segments to escape the intended /transcribe/ prefix and proxy requests to other internal endpoints, potentially exposing administrative, health, or configuration data. This issue is fixed in version 3.7.7.
- CVE-2026-55179Medium
Joplin Server before version 3.7.2 has a vulnerability in the GET /items/:id/content route that loads item content from an attacker-supplied internal server ID without checking whether the signed-in user owns or can access that item. Any authenticated user who obtains or guesses another user's item ID can read the corresponding note or item content when end-to-end encryption does not protect it. This issue is fixed in version 3.7.2.
- CVE-2026-46649Critical
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /api/login_with_code/:id endpoint accepts a nine-digit SSO authentication code with a ten-minute lifetime without applying limiterLoginBruteForce. An unauthenticated attacker who targets a user during an active SSO login can make unlimited guesses, and a correct code returns a full session token that permits access to and modification of the user's notes, notebooks, and account settings.
Original NVD description (English source)
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's GET /shares/:id?resource_id= route serves a resource with the attacker-controlled mime value and omits Content-Disposition when the resource title is empty. A low-privileged user can publish an empty-title image/svg+xml attachment whose script executes when a victim opens the public share. By default, user content shares the Joplin Server application origin, allowing the script to access same-origin data and, when the victim is authenticated, perform actions with the victim's session, including reading administrative data and anti-CSRF tokens. Installations that configure USER_CONTENT_BASE_URL to a separate origin still execute the script, but on that separate user-content origin rather than the application origin. This issue is fixed in version 3.7.7.