CVE-2026-25642
Medium
Description
HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.6, files served below the /uploads/ endpoint did not use a more strict security-policy. This resulted in a too open Content-Security-Policy and furthermore opened the possibility to host malicious interactive web content (such as fake login forms) using SVG files. This vulnerability is fixed in 1.10.6.
SeverityMedium
CVSS4.3
Exploit probability—
ProductHedgedoc
PublishedFeb 6, 2026
First seenFeb 6, 2026
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- hedgedoc hedgedoc1.10.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hedgedoc hedgedoc | v < 1.10.6 | 1.10.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.