Advisories · Technology

hedgedoc.

Every CVE that names hedgedoc among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-102927 CVE record

CVSS 5.9 Medium

HedgeDoc: Missing validation of incoming permission values on change
- hedgedoc
- Broken access control
- CWE-20
Not analysed yet 5 Nov 2026
CVE-2026-58489 CVE record

CVSS 6.8 Medium

HedgeDoc: CSRF in GitHub Gist export callback
- hedgedoc
- Cross-site request forgery (CSRF)
Not analysed yet 13 Jul 2026
CVE-2026-58486 CVE record

CVSS 8.3 High

HedgeDoc: Denial-of-service via YAML alias expansion in note frontmatter
- hedgedoc
- Denial of service
- CWE-409
Not analysed yet 13 Jul 2026
CVE-2026-58487 CVE record

CVSS 5.1 Medium

HedgeDoc: Stored HTML injection via email local-part
- hedgedoc
- Cross-site scripting (XSS)
- CWE-116
Not analysed yet 13 Jul 2026
CVE-2026-58488 CVE record

CVSS 6.9 Medium

HedgeDoc: Rate-limit bypass via CF-Connecting-IP header spoofing
- hedgedoc
- Authentication bypass
- Denial of service
Not analysed yet 13 Jul 2026
CVE-2026-25642 CVE record

CVSS 4.3 Medium

HedgeDoc security headers for uploaded files were not working
- hedgedoc
- Cross-site scripting (XSS)
Not analysed yet 6 Feb 2026
CVE-2025-66629 CVE record

CVSS 3.7 Low

HedgeDoc is missing state parameter in OAuth2 flows could lead to CSRF
- hedgedoc
- Cross-site request forgery (CSRF)
Not analysed yet 5 Dec 2025
CVE-2025-32391 CVE record

CVSS 6.4 Medium

HedgeDoc allows XSS possibility through malicious SVG uploads
- hedgedoc
- Cross-site scripting (XSS)
Not analysed yet 10 Apr 2025
CVE-2024-45308 CVE record

CVSS 6.5 Medium

MySQL & free URL mode allows to hide existing notes in hedgedoc
- hedgedoc
- CWE-1289
Not analysed yet 2 Sept 2024
CVE-2023-38487 CVE record

CVSS 6.5 Medium

HedgeDoc API allows to hide existing notes
- hedgedoc
- CWE-289
Not analysed yet 4 Aug 2023
CVE-2022-24837 CVE record

CVSS 5.3 Medium

Enumerable upload file names in hedgedoc
- hedgedoc
- Information disclosure
Not analysed yet 11 Apr 2022
CVE-2021-39175 CVE record

CVSS 8.1 High

XSS vector in slide mode speaker-view
- hedgedoc
- Other injection
- CWE-346
Not analysed yet 30 Aug 2021
CVE-2021-29503 CVE record

CVSS 8.1 High

Improper Neutralization of Script-Related HTML Tags in Notes
- hedgedoc
- Cross-site scripting (XSS)
Not analysed yet 19 May 2021
CVE-2021-29474 CVE record

CVSS 4.7 Medium

Relative Path Traversal Attack on note creation
- hedgedoc
- Path traversal
- CWE-20
Not analysed yet 26 Apr 2021
CVE-2021-29475 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

PDF export allows arbitrary file reads
- hedgedoc
- Code injection
- Server-side request forgery (SSRF)
Not analysed yet 26 Apr 2021
CVE-2021-21259 CVE record

CVSS 7.4 High

Stored XSS in slide mode
- hedgedoc
- Cross-site scripting (XSS)
Not analysed yet 22 Jan 2021
CVE-2020-26287 CVE record

CVSS 8.7 High

Stored XSS in mermaid diagrams
- hedgedoc
- Cross-site scripting (XSS)
Not analysed yet 28 Dec 2020
CVE-2020-26286 CVE record

CVSS 7.5 High

Arbitary file upload
- hedgedoc
- Unrestricted file upload
Not analysed yet 28 Dec 2020