CVE-2026-25642

MEDIUM

HedgeDoc < 1.10.6 - Stored Cross-Site Scripting via SVG Upload

Title source: llm
STIX 2.1

Description

HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.6, files served below the /uploads/ endpoint did not use a more strict security-policy. This resulted in a too open Content-Security-Policy and furthermore opened the possibility to host malicious interactive web content (such as fake login forms) using SVG files. This vulnerability is fixed in 1.10.6.

References (4)

Core 4

Scores

CVSS v3 4.3
EPSS 0.0019
EPSS Percentile 9.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (1)
hedgedoc/hedgedoc < 1.10.6
Published Feb 06, 2026
Tracked Since Feb 18, 2026