Vulnerabilities in hedgedoc
18 resultsCVE-2021-29474MEDIUMRelative Path Traversal Attack on note creationEPSS 1.6%CVE-2020-26287HIGHStored XSS in mermaid diagramsEPSS 1.5%CVE-2020-26286HIGHArbitary file uploadEPSS 1.4%CVE-2021-21259HIGHStored XSS in slide modeEPSS 1.4%CVE-2021-29475CRITICALPDF export allows arbitrary file readsEPSS 1.2%CVE-2022-24837MEDIUMEnumerable upload file names in hedgedocEPSS 1.1%CVE-2021-29503HIGHImproper Neutralization of Script-Related HTML Tags in NotesEPSS 1.0%CVE-2023-38487MEDIUMHedgeDoc API allows to hide existing notesEPSS 0.8%CVE-2021-39175HIGHXSS vector in slide mode speaker-viewEPSS 0.6%CVE-2024-45308MEDIUMMySQL & free URL mode allows to hide existing notes in hedgedocEPSS 0.6%CVE-2026-58487MEDIUMHedgeDoc: Stored HTML injection via email local-partEPSS 0.5%CVE-2026-58488MEDIUMHedgeDoc: Rate-limit bypass via CF-Connecting-IP header spoofingEPSS 0.4%CVE-2026-58486HIGHHedgeDoc: Denial-of-service via YAML alias expansion in note frontmatterEPSS 0.4%CVE-2025-32391MEDIUMHedgeDoc allows XSS possibility through malicious SVG uploadsEPSS 0.3%CVE-2026-102927MEDIUMHedgeDoc: Missing validation of incoming permission values on changeEPSS 0.3%CVE-2026-25642MEDIUMHedgeDoc security headers for uploaded files were not workingEPSS 0.2%CVE-2026-58489MEDIUMHedgeDoc: CSRF in GitHub Gist export callbackEPSS 0.2%CVE-2025-66629LOWHedgeDoc is missing state parameter in OAuth2 flows could lead to CSRFEPSS 0.1%