{"id":"CVE-2026-119764","aliases":["EUVD-2026-114241","GHSA-m857-xf4f-qjf2"],"status":"published","title":"Mythic 3.2.16 through 3.4.0.61 Stored XSS via Agent-Downloaded File Preview","description":"Mythic 3.2.16 through 3.4.0.61 contains a stored cross-site scripting vulnerability that allows attackers controlling target endpoint files to run JavaScript in the Mythic UI origin by planting HTML in .pdf-named files. When an operator downloads the file and clicks Preview Media, content-sniffed HTML from /direct/view renders same-origin, stealing localStorage JWTs for full GraphQL and REST access.","severity":{"version":"4.0","score":7.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00317,"percentile":0.24958,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-10-30T17:19:55Z","modified":"2026-11-05T03:17:20Z","products":[{"vendor":"its-a-feature","product":"mythic"}],"references":[{"url":"https://github.com/h00die/mythic_xss","tags":["third-party-advisory","exploit","advisory"]},{"url":"https://github.com/its-a-feature/Mythic/commit/f06b3ed2d1de6577744cc0b3146966c625685859","tags":["patch","fix"]},{"url":"https://github.com/its-a-feature/Mythic/blob/33a46d7db7e237458d7e20e7d3cfefef8112e590/MythicReactUI/src/components/pages/Callbacks/ResponseDisplayMedia.js#L335-L336","tags":["technical-description","article"]},{"url":"https://github.com/its-a-feature/Mythic","tags":["product","package"]},{"url":"https://www.vulncheck.com/advisories/mythic-3.2.16-through-3.4.0.61-stored-xss-via-agent-downloaded-file-preview","tags":["third-party-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119764","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-m857-xf4f-qjf2"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119764.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-119764","title":"Mythic 3.2.16 through 3.4.0.61 Stored XSS via Agent-Downloaded File Preview","description":"Mythic 3.2.16 through 3.4.0.61 contains a stored cross-site scripting vulnerability that allows attackers controlling target endpoint files to run JavaScript in the Mythic UI origin by planting HTML in .pdf-named files. When an operator downloads the file and clicks Preview Media, content-sniffed HTML from /direct/view renders same-origin, stealing localStorage JWTs for full GraphQL and REST access.","status":"published","published":"2026-10-30T17:19:55.892Z","modified":"2026-11-05T02:27:10.275Z","cvss":[{"version":"4.0","score":7.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-05T06:56:15.67765Z"}],"euvd":[{"id":"EUVD-2026-114241","description":"Mythic 3.2.16 through 3.4.0.61 contains a stored cross-site scripting vulnerability that allows attackers controlling target endpoint files to run JavaScript in the Mythic UI origin by planting HTML in .pdf-named files. When an operator downloads the file and clicks Preview Media, content-sniffed HTML from /direct/view renders same-origin, stealing localStorage JWTs for full GraphQL and REST access.","status":"published","published":"2026-10-30T17:19:55Z","modified":"2026-11-05T02:27:10Z","cvss":[{"version":"4.0","score":7.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-05T06:54:34.509968Z"}],"ghsa":[{"id":"GHSA-m857-xf4f-qjf2","title":"Mythic 3.2.16 through 3.4.0.61 contains a stored cross-site scripting vulnerability that allows...","description":"Mythic 3.2.16 through 3.4.0.61 contains a stored cross-site scripting vulnerability that allows attackers controlling target endpoint files to run JavaScript in the Mythic UI origin by planting HTML in .pdf-named files. When an operator downloads the file and clicks Preview Media, content-sniffed HTML from /direct/view renders same-origin, stealing localStorage JWTs for full GraphQL and REST access.","status":"published","published":"2026-10-30T18:32:44Z","modified":"2026-10-30T18:32:48Z","cvss":[{"version":"4.0","score":7.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:14:52.01816Z"}],"nvd":[{"id":"CVE-2026-119764","description":"Mythic 3.2.16 through 3.4.0.61 contains a stored cross-site scripting vulnerability that allows attackers controlling target endpoint files to run JavaScript in the Mythic UI origin by planting HTML in .pdf-named files. When an operator downloads the file and clicks Preview Media, content-sniffed HTML from /direct/view renders same-origin, stealing localStorage JWTs for full GraphQL and REST access.","status":"published","published":"2026-10-30T18:17:27.273Z","modified":"2026-11-05T03:17:20.61Z","cvss":[{"version":"4.0","score":7.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-05T06:56:49.198795Z"}],"osv":[{"id":"CVE-2026-119764","title":"Mythic 3.2.16 through 3.4.0.61 Stored XSS via Agent-Downloaded File Preview","description":"Mythic 3.2.16 through 3.4.0.61 contains a stored cross-site scripting vulnerability that allows attackers controlling target endpoint files to run JavaScript in the Mythic UI origin by planting HTML in .pdf-named files. When an operator downloads the file and clicks Preview Media, content-sniffed HTML from /direct/view renders same-origin, stealing localStorage JWTs for full GraphQL and REST access.","status":"published","published":"2026-10-30T17:19:55.892Z","modified":"2026-11-05T21:15:52.519955055Z","cvss":[{"version":"4.0","score":7.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-05T22:01:21.792402Z"}]}}