HedgeDoc security headers for uploaded files were not working
Priority LOW 27CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.6, files served below the /uploads/ endpoint did not use a more strict security-policy. This resulted in a too open Content-Security-Policy and furthermore opened the possibility to host malicious interactive web content (such as fake login forms) using SVG files. This vulnerability is fixed in 1.10.6.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00236 14th percentileScored 2026-11-07
Fix Fixed hedgedoc (hedgedoc): 1.10.6
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA hedgedoc (hedgedoc) Fixed in 1.10.6
Timeline
- 2026-10-02 Threatist record created from CVE-2026-25642
References
Patch 3
More Hedgedoc vulnerabilities
- TI-2023-19867 HedgeDoc API allows to hide existing notes CVSS 3.1HIGH 8.2
- TI-2024-30379 MySQL & free URL mode allows to hide existing notes in hedgedoc CVSS 3.1MEDIUM 6.5
- TI-2021-10188 PDF export allows arbitrary file reads CVSS 3.1CRITICAL 10.0
- TI-2020-16108 Stored XSS in mermaid diagrams CVSS 3.1HIGH 8.7
- TI-2021-10211 Improper Neutralization of Script-Related HTML Tags in Notes CVSS 3.1HIGH 8.1
- TI-2021-16561 XSS vector in slide mode speaker-view CVSS 3.1HIGH 8.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences