Vulnerability · Published Feb 6, 2026 · Assigned by GitHub_M

CVE-2026-25642HedgeDoc security headers for uploaded files were not working

Medium 4.3

In plain English

A medium-severity cross-site scripting in hedgedoc from hedgedoc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 85.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.6, files served below the /uploads/ endpoint did not use a more strict security-policy. This resulted in a too open Content-Security-Policy and furthermore opened the possibility to host malicious interactive web content (such as fake login forms) using SVG files. This vulnerability is fixed in 1.10.6.

Affected products (as reported)

Vendor	Product	Versions
hedgedoc	hedgedoc	< 1.10.6

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References

https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-x74j-jmf9-534w x_refsource_CONFIRM
https://github.com/hedgedoc/hedgedoc/commit/74daa0e7a1cbfafd9aeb255eaf064dfe47cd401c x_refsource_MISC
https://github.com/hedgedoc/hedgedoc/commit/b930fe04cee92cd4723044030bb59c36781c7137 x_refsource_MISC
https://github.com/hedgedoc/hedgedoc/releases/tag/1.10.6 x_refsource_MISC