CVE-2026-59814

Summary

Joplin Server allows low-privileged users to upload attachments with empty titles that execute arbitrary scripts when victims open public shares. This enables attackers to perform actions on behalf of authenticated victims using same-origin script execution.

Exploitability

Moderately difficult to exploit as it requires a low-privileged user to create an empty-title attachment and convince a victim to open the public share, but the attack vector is straightforward once the precondition is met.

Blast radius

The impact could be significant as attackers can access same-origin data, read administrative information, and perform actions with victim sessions, potentially leading to privilege escalation or data exfiltration.

Detection

Monitor for unusual GET requests to /shares/ endpoints with empty resource titles, and check for script execution patterns in shared content when users access public shares.

Prioritized remediation

Upgrade to Joplin Server 3.7.7 or later to fix the vulnerability in the GET /shares/:id?resource_id= route.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.