CVE-2026-25642

HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.6, files served below the /uploads/ endpoint did not use a more strict security-policy. This resulted in a too open Content-Security-Policy and furthermore opened the possibility to host malicious interactive web content (such as fake login forms) using SVG files. This vulnerability is fixed in 1.10.6.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/hedgedoc/hedgedoc/commit/74daa0e7a1cbfafd9aeb255eaf064dfe47cd401c	Patch
https://github.com/hedgedoc/hedgedoc/commit/b930fe04cee92cd4723044030bb59c36781c7137	Patch
https://github.com/hedgedoc/hedgedoc/releases/tag/1.10.6	Product Release Notes
https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-x74j-jmf9-534w	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:hedgedoc:hedgedoc:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-02-06 20:16

Updated : 2026-02-25 14:45

NVD link : CVE-2026-25642

Mitre link : CVE-2026-25642

CVE.ORG link : CVE-2026-25642

JSON object : View

Products Affected

hedgedoc

hedgedoc

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-25642", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2026-02-06T20:16:11.437", "references": [{"url": "https://github.com/hedgedoc/hedgedoc/commit/74daa0e7a1cbfafd9aeb255eaf064dfe47cd401c", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/hedgedoc/hedgedoc/commit/b930fe04cee92cd4723044030bb59c36781c7137", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/hedgedoc/hedgedoc/releases/tag/1.10.6", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-x74j-jmf9-534w", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.6, files served below the /uploads/ endpoint did not use a more strict security-policy. This resulted in a too open Content-Security-Policy and furthermore opened the possibility to host malicious interactive web content (such as fake login forms) using SVG files. This vulnerability is fixed in 1.10.6."}, {"lang": "es", "value": "HedgeDoc es una aplicaci\u00f3n de notas markdown de c\u00f3digo abierto, en tiempo real y colaborativa. Antes de la versi\u00f3n 1.10.6, los archivos servidos bajo el endpoint /uploads/ no utilizaban una pol\u00edtica de seguridad m\u00e1s estricta. Esto result\u00f3 en una Content-Security-Policy demasiado abierta y adem\u00e1s abri\u00f3 la posibilidad de alojar contenido web interactivo malicioso (como formularios de inicio de sesi\u00f3n falsos) utilizando archivos SVG. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 1.10.6."}], "lastModified": "2026-02-25T14:45:01.257", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hedgedoc:hedgedoc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EAB0E1A5-8DC9-4EEB-ADA5-12A10143EE18", "versionEndExcluding": "1.10.6"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}