Read the docs
TI-2022-08649 Aliases CVE-2022-24837

Enumerable upload file names in hedgedoc

Priority LOW 32CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, Code execution
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200 and CWE-434.

Summary

HedgeDoc is an open-source, web-based, self-hosted, collaborative markdown editor. Images uploaded with HedgeDoc version 1.9.1 and later have an enumerable filename after the upload, resulting in potential information leakage of uploaded documents. This is especially relevant for private notes and affects all upload backends, except Lutim and imgur. This issue is patched in version 1.9.3 by replacing the filename generation with UUIDv4. If you cannot upgrade to HedgeDoc 1.9.3, it is possible to block POST requests to `/uploadimage`, which will disable future uploads.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01126 66th percentileScored 2026-11-07
Fix Fixed hedgedoc (hedgedoc): 1.9.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
hedgedochedgedoc1.9.1 to before 1.9.31.9.3Patch availableCNA
  • hedgedoc Vendorhedgedoc Affected 1.9.1 to before 1.9.3 Fixed in 1.9.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:hedgedoc:hedgedoc:*:*:*:*:*:*:*:*1.9.1 to before 1.9.3Vulnerablehedgedoc
  • cpe:2.3:a:hedgedoc:hedgedoc:*:*:*:*:*:*:*:* Versions 1.9.1 to before 1.9.3 Vulnerable ·hedgedoc

Remediation

  • Fix · CNA hedgedoc (hedgedoc) Fixed in 1.9.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-24837

References

Patch 2

Advisory 1

  • TI-2023-19867 HedgeDoc API allows to hide existing notes CVSS 3.1HIGH 8.2
  • TI-2024-30379 MySQL & free URL mode allows to hide existing notes in hedgedoc CVSS 3.1MEDIUM 6.5
  • TI-2021-10188 PDF export allows arbitrary file reads CVSS 3.1CRITICAL 10.0
  • TI-2020-16108 Stored XSS in mermaid diagrams CVSS 3.1HIGH 8.7
  • TI-2021-10211 Improper Neutralization of Script-Related HTML Tags in Notes CVSS 3.1HIGH 8.1
  • TI-2021-16561 XSS vector in slide mode speaker-view CVSS 3.1HIGH 8.1
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences