# CVE-2026-59814: Joplin Server stored XSS in resource sharing via empty title

Source: https://junglewise.ai/threats/cve-2026-59814-joplin-is-an-open-source-note-taking-and-to-do-application-that  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-21. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-59814 · Severity: high · CVSS 7.6 · Published 2026-09-21

Joplin Server is an open-source note-taking application. A low-privileged user can upload an image file with an empty title and malicious script, then share it publicly. When a victim opens the shared note, the attacker's script executes in the victim's browser with access to sensitive data and the ability to perform actions on their behalf, including reading administrative information.

Technologies: [Joplin Server](https://junglewise.ai/threats/technologies/joplin-server). Vendors: [Joplin](https://junglewise.ai/threats/vendors/joplin).

## Quick answers

**Is CVE-2026-59814 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59814 being exploited in the wild.

**How severe is CVE-2026-59814?** High severity, with a CVSS score of 7.6, published 21 September 2026.

**Which products and versions are affected?** Joplin Server prior to 3.7.7.

**Is there a fix for CVE-2026-59814?** A patch was published on 2026-06-28: Fix merged in commit 920cd8f Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59814 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-59814?** Check whether you run Joplin Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The GET /shares/:id?resource_id= endpoint serves user-uploaded resources with an attacker-controlled MIME type and omits Content-Disposition headers when the resource title is empty, enabling stored XSS. An attacker can craft an SVG file (image/svg+xml) with embedded script and empty title; when rendered inline without proper headers and CSP, the script executes in the Joplin Server origin, allowing access to same-origin data and authenticated user sessions. The fix restricts inline MIME types to a whitelist (images, audio, video, PDF), forces other types to application/octet-stream with attachment disposition, and adds X-Content-Type-Options: nosniff and strict CSP headers.

## Affected products

- Joplin Server prior to 3.7.7

## Timeline

- 2026-09-21: disclosed
- 2026-06-28: patched: Fix merged in commit 920cd8f

## References

- [https://github.com/laurent22/joplin/commit/920cd8f463bf9bbce9daa07581676123007118e5](https://github.com/laurent22/joplin/commit/920cd8f463bf9bbce9daa07581676123007118e5)
- [https://github.com/laurent22/joplin/pull/15787](https://github.com/laurent22/joplin/pull/15787)

## Related threats

- [Joplin Server account takeover via application authorization bypass](https://junglewise.ai/threats/cve-2026-105786-joplin-is-an-open-source-note-taking-and-to-do-application-that)
- [Joplin Server token misuse in password reset](https://junglewise.ai/threats/cve-2026-105785-joplin-is-an-open-source-note-taking-and-to-do-application-that)
- [Joplin Server SAML authentication bypass to local account access](https://junglewise.ai/threats/cve-2026-55210-joplin-is-an-open-source-note-taking-and-to-do-application-that)
- [Joplin Server path traversal in transcribe proxy](https://junglewise.ai/threats/cve-2026-59816-joplin-is-an-open-source-note-taking-and-to-do-application-that)
- [Joplin Server authentication brute force in SSO endpoint](https://junglewise.ai/threats/cve-2026-46649-joplin-is-an-open-source-note-taking-and-to-do-application-that)