Description

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's GET /shares/:id?resource_id= route serves a resource with the attacker-controlled mime value and omits Content-Disposition when the resource title is empty. A low-privileged user can publish an empty-title image/svg+xml attachment whose script executes when a victim opens the public share. By default, user content shares the Joplin Server application origin, allowing the script to access same-origin data and, when the victim is authenticated, perform actions with the victim's session, including reading administrative data and anti-CSRF tokens. Installations that configure USER_CONTENT_BASE_URL to a separate origin still execute the script, but on that separate user-content origin rather than the application origin. This issue is fixed in version 3.7.7.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-09-21T22:16:57.050Z",
  "pubdate": "2026-09-21T22:16:57.050Z",
  "executiveSummary": "Joplin Server prior to version 3.7.7 contains a Stored Cross-Site Scripting (XSS) vulnerability within the file sharing mechanism.\nThe vulnerability originates from improper handling of resource MIME types and missing Content-Disposition headers for notes with empty titles.\nAn authenticated low-privileged user can upload a maliciously crafted image/svg+xml file that, when accessed via a public share link, executes arbitrary JavaScript in the context of the victim's session.\nIf the Joplin Server is configured to share the application origin, the payload can access sensitive data, session tokens, and perform administrative actions on behalf of the victim.\nThe flaw persists even when a separate USER_CONTENT_BASE_URL is utilized, although the impact is restricted to that secondary origin.\nSuccessful exploitation requires the victim to access a shared resource link, posing a significant risk to data confidentiality and integrity.",
  "technicalDetails": "The vulnerability exists in the GET /shares/:id?resource_id= route within the Joplin Server application. The root cause is the server's failure to enforce strict Content-Type headers or secure browser-side rendering policies when serving user-uploaded resources.\nSpecifically, when an attachment has an empty title, the server fails to provide a Content-Disposition: attachment header, which would normally force the browser to download the file rather than rendering it directly within the document object model (DOM).\nBecause the server respects the attacker-controlled MIME type, an attacker can designate a malicious SVG file as image/svg+xml. When a victim navigates to the public share URL, the browser interprets the SVG file as a legitimate document and executes any embedded <script> tags contained within the XML content.\nIf the server is not configured with a separate origin for user content, the script executes within the primary application origin. This permits the script to bypass Same-Origin Policy (SOP) restrictions, enabling the attacker to read session cookies, extract anti-CSRF tokens, and execute authenticated API calls to modify or exfiltrate application data, including administrative-level information.\nIn scenarios where a separate USER_CONTENT_BASE_URL is configured, the browser executes the script within that isolated origin. While this prevents direct access to the main application's session cookies, it still allows for malicious operations within the scope of that origin and demonstrates a failure to provide adequate content sanitization for user-provided resources.\nThe exploitation flow is as follows: 1) A low-privileged attacker crafts an SVG image containing a malicious JavaScript payload. 2) The attacker uploads this file as an attachment to a note with an empty title. 3) The attacker publishes the note to generate a public share link. 4) The attacker lures a victim (including potential administrators) to access the public link. 5) Upon navigation, the browser renders the SVG, triggers the script execution, and potentially performs unauthorized actions or data theft depending on the origin configuration."
}