A high-severity Cross-site Scripting vulnerability in Joplin Server allows authenticated low-privileged users to execute malicious scripts in the context of other users or administrators.

This is a Stored Cross-site Scripting (CWE-79) vulnerability occurring within the GET /shares/:id?resource_id= route. A low-privileged user can upload a maliciously crafted image/svg+xml file with an empty title, which the server serves without proper content neutralization, allowing script execution when a victim views the shared resource.

Successful exploitation allows an attacker to perform unauthorized actions within the victim's session, including access to sensitive administrative data or extraction of anti-CSRF tokens. Given the CVSS score of 7.6, the vulnerability represents a significant risk to data confidentiality and integrity. The ability for an attacker to hijack active sessions poses a severe threat to the overall security posture of the Joplin environment.

Immediate Action: Upgrade Joplin Server to version 3.7.7 or later to implement the necessary content-disposition and MIME type handling fixes.

Proactive Monitoring: Review web server access logs for anomalous requests to the /shares/ endpoint, particularly those involving SVG file types or unusual resource parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious script injection attempts and unexpected SVG content uploads.

Public Exploit Available: No (exploit_available: false)

The risk posed by this XSS vulnerability is substantial due to the potential for session hijacking and administrative compromise. Security teams should prioritize the update to version 3.7.7 across all affected Joplin Server instances immediately to ensure that user-submitted content is correctly neutralized and cannot be used to execute arbitrary scripts in the application origin.