CVE-2026-59814: Joplin: Stored XSS via inline-served note attachment on published shares
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's GET /shares/:id?resourceid= route serves a resource with the attacker-controlled mime value and omits Content-Disposition when the resource title is empty. A low-privileged user can publish an empty-title image/svg+xml attachment whose script executes when a victim opens the public share. By default, user content shares the Joplin Server application origin, allowing the script to access same-origin data and, when the victim is authenticated, perform actions with the victim's session, including reading administrative data and anti-CSRF tokens. Installations that configure USERCONTENTBASEURL to a separate origin still execute the script, but on that separate user-content origin rather than the application origin. This issue is fixed in version 3.7.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Joplin Serverto a version that resolves this vulnerability.Fixed in 3.7.7Patch Joplin: Stored XSS via inline-served note attachment on published shares - Configuration
Configure USER_CONTENT_BASE_URL to a separate origin so published share attachments execute on the user-content origin rather than the Joplin Server application origin.
Joplin Server USER_CONTENT_BASE_URL = separate origin
Event History
Frequently Asked Questions
Who can exploit this issue, and what user interaction is required?
A low-privileged Joplin user who can publish a share can exploit the issue by attaching an empty-title SVG resource with an attacker-controlled MIME type. A victim must open the public share for the embedded script to execute.
Are default Joplin Server deployments exposed to same-origin impact?
Yes. By default, shared user content uses the Joplin Server application origin, so the script can access same-origin data and act through an authenticated victim's session, including reading administrative data and anti-CSRF tokens.
Does configuring USER_CONTENT_BASE_URL reduce the impact?
It separates user content onto another origin, preventing the script from executing on the application origin. The malicious script still executes when the share is opened, but it runs on the separate user-content origin.
What version fixes the vulnerability?
Upgrade Joplin Server to version 3.7.7 or later. The issue affects versions prior to 3.7.7.