The vulnerability is a stored XSS triggered through an inline‑served note attachment when a shared note has an empty title and a MIME type of image/svg+xml. An attacker can upload an empty‑title attachment containing malicious JavaScript; when a user opens the public share, the script executes in the context of the Joplin Server’s origin. Because the user‑content shares the same origin by default, the script can read protected admin data, fetch anti‑CSRF tokens, and perform authenticated actions on behalf of the victim. Even installations that redirect user content to a separate origin still allow execution in that new origin rather than the main application origin, so the exposed reach is not eliminated.

The weakness affects Joplin Server installations running a version earlier than 3.7.7. This includes all servers that provide the GET /shares/:id?resource_id= endpoint and allow attachments with MIME type image/svg+xml and empty titles to be published via the public share functionality. The vendors involved are Joplin by laurent22.

The CVSS score is 7.6, indicating a high severity. The EPSS score is not available, so we cannot quantify current exploitation likelihood, but the lack of KEV listing suggests no known active exploitation at present. The attack requires a low‑privileged user to publish a malicious attachment and a victim to open the public share URL. If such a shared link is distributed to a user who is logged into Joplin, the browser will execute the script and allow the attacker to perform same‑origin actions. Because the script runs in the browser context tied to the Joplin Server origin, it is relatively easy to achieve the payload once the share is accessed, making exploitation straightforward for an attacker who can entice or trick a victim into viewing the shared note.