CVE-2026-59814: Joplin Server: stored XSS via SVG share, session abuse

HIGHCISA: TRACK*

Published September 21, 2026

CISO Take

Joplin Server before 3.7.7 lets a low-privileged user publish an empty-title SVG attachment that is served with an attacker-controlled MIME type and no Content-Disposition header, so its script runs when a victim opens the public share link. By default this executes on the Joplin Server application origin, so the script can read same-origin data, anti-CSRF tokens and administrative data, and act with the victim's session, which makes admin targeting the main concern (CVSS 7.6, scope changed). Exploitation likelihood is currently modest: EPSS is 0.0035 (top 73%), the CVE is not in CISA KEV, there is no public exploit or Nuclei template, and SSVC is TRACK*. The relevance to AI is indirect, since Joplin is a note-taking tool that some teams use to hold AI/ML research notes, prompts and credentials. Upgrade to 3.7.7 and set USER_CONTENT_BASE_URL to a separate origin to limit the blast radius.

Sources:NVDEPSSGitHub AdvisoryATLAS

What is the risk?

Medium-high for self-hosted Joplin Server instances that have multiple users or expose shares. Exploitation is low complexity and needs only a low-privileged account plus one click from the victim. The scope change and high confidentiality impact raise the risk when the victim is an administrator. Active exploitation is not observed, and the EPSS score is low. The AI/ML link is incidental: it applies only where teams store model notes, API keys or prompt libraries in Joplin.

How does the attack unfold?

Initial Access

A low-privileged user uploads an empty-title SVG with a malicious script and publishes it as a share.

AML.T0049

User Execution

The victim opens the public share link and the browser renders the SVG inline without Content-Disposition.

AML.T0078

Exploitation

The script runs on the application origin and reads anti-CSRF tokens and admin data using the victim's session.

Impact

The attacker performs authenticated actions or exfiltrates notes, prompts and credentials stored in Joplin.

Initial Access

A low-privileged user uploads an empty-title SVG with a malicious script and publishes it as a share.

AML.T0049

User Execution

The victim opens the public share link and the browser renders the SVG inline without Content-Disposition.

AML.T0078

Exploitation

The script runs on the application origin and reads anti-CSRF tokens and admin data using the victim's session.

Impact

The attacker performs authenticated actions or exfiltrates notes, prompts and credentials stored in Joplin.

How severe is it?

CVSS 3.1

7.6 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 29% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UIRequired

SChanged

CHigh

ILow

ANone

What should I do?

6 steps

Upgrade Joplin Server to 3.7.7 or later (fix in PR 15787, commit 920cd8f).
Set USER_CONTENT_BASE_URL to a separate origin so shared content cannot reach application-origin data.
Restrict who can create accounts and publish shares until patched; disable public sharing if it is not needed.
Review existing shared resources for SVG attachments with empty titles or image/svg+xml MIME types.
Add a Content-Security-Policy and Content-Disposition: attachment at the reverse proxy for user-content paths as a stopgap.
Rotate any secrets or API keys stored in notes if admin sessions may have been exposed.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data LeakageAuth BypassPluginAML.T0049- Exploit Public-Facing Application AML.T0078- Drive-by Compromise

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.7.2-Data for development and enhancement of AI system

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks and vulnerabilities are managed

Frequently Asked Questions

What is CVE-2026-59814?

Is CVE-2026-59814 actively exploited?

No confirmed active exploitation of CVE-2026-59814 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-59814?

1. Upgrade Joplin Server to 3.7.7 or later (fix in PR 15787, commit 920cd8f). 2. Set USER_CONTENT_BASE_URL to a separate origin so shared content cannot reach application-origin data. 3. Restrict who can create accounts and publish shares until patched; disable public sharing if it is not needed. 4. Review existing shared resources for SVG attachments with empty titles or image/svg+xml MIME types. 5. Add a Content-Security-Policy and Content-Disposition: attachment at the reverse proxy for user-content paths as a stopgap. 6. Rotate any secrets or API keys stored in notes if admin sessions may have been exposed.

What systems are affected by CVE-2026-59814?

This vulnerability affects the following AI/ML architecture patterns: Self-hosted note-taking and knowledge management servers, Collaboration tools holding AI/ML documentation and credentials.

What is the CVSS score for CVE-2026-59814?

CVE-2026-59814 has a CVSS v3.1 base score of 7.6 (HIGH). The EPSS exploitation probability is 0.35%.

What is the AI security impact?

Affected AI Architectures

Self-hosted note-taking and knowledge management serversCollaboration tools holding AI/ML documentation and credentials

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0078Drive-by Compromise

Compliance Controls Affected

ISO 42001: A.7.2

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's GET /shares/:id?resource_id= route serves a resource with the attacker-controlled mime value and omits Content-Disposition when the resource title is empty. A low-privileged user can publish an empty-title image/svg+xml attachment whose script executes when a victim opens the public share. By default, user content shares the Joplin Server application origin, allowing the script to access same-origin data and, when the victim is authenticated, perform actions with the victim's session, including reading administrative data and anti-CSRF tokens. Installations that configure USER_CONTENT_BASE_URL to a separate origin still execute the script, but on that separate user-content origin rather than the application origin. This issue is fixed in version 3.7.7.

Exploitation Scenario

An attacker with a low-privileged account on a shared Joplin Server uploads an SVG attachment containing JavaScript, leaves its title empty and sets the MIME type to image/svg+xml. They publish the resource as a share and send the link to an administrator, for example as a reference to ML experiment notes. When the administrator opens it while logged in, the script runs on the application origin, reads the anti-CSRF token and admin data, and makes authenticated requests to create a rogue admin account or exfiltrate notes holding prompts and API credentials.

Weaknesses (CWE)

CWE-79Improper Neutralization of Input During Web Page GenerationPrimary CWE-79Improper Neutralization of Input During Web Page Generation

CWE-79 — Improper Neutralization of Input During Web Page Generation: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.