Hedgedoc vulnerabilities

Products

• Hedgedoc 18

Newest

• hedgedoc HedgeDoc: Missing validation of incoming permission values on change CVE-2026-102927 5.9 MediumNovember 5, 2026
• hedgedoc HedgeDoc: CSRF in GitHub Gist export callback CVE-2026-58489 6.8 MediumJuly 13, 2026
• hedgedoc HedgeDoc: Denial-of-service via YAML alias expansion in note frontmatter CVE-2026-58486 8.3 HighJuly 13, 2026
• hedgedoc HedgeDoc: Stored HTML injection via email local-part CVE-2026-58487 5.1 MediumJuly 13, 2026
• hedgedoc HedgeDoc: Rate-limit bypass via CF-Connecting-IP header spoofing CVE-2026-58488 6.9 MediumJuly 13, 2026
• hedgedoc HedgeDoc security headers for uploaded files were not working CVE-2026-25642 4.3 MediumFebruary 6, 2026
• hedgedoc HedgeDoc is missing state parameter in OAuth2 flows could lead to CSRF CVE-2025-66629 3.7 LowDecember 5, 2025
• hedgedoc HedgeDoc allows XSS possibility through malicious SVG uploads CVE-2025-32391 6.4 MediumApril 10, 2025
• hedgedoc MySQL & free URL mode allows to hide existing notes in hedgedoc CVE-2024-45308 6.5 MediumSeptember 2, 2024
• hedgedoc HedgeDoc API allows to hide existing notes CVE-2023-38487 6.5 MediumAugust 4, 2023
• hedgedoc Enumerable upload file names in hedgedoc CVE-2022-24837 5.3 MediumApril 11, 2022
• hedgedoc XSS vector in slide mode speaker-view CVE-2021-39175 8.1 HighAugust 30, 2021
• hedgedoc Improper Neutralization of Script-Related HTML Tags in Notes CVE-2021-29503 8.1 HighMay 19, 2021
• hedgedoc Relative Path Traversal Attack on note creation CVE-2021-29474 4.7 MediumApril 26, 2021
• hedgedoc PDF export allows arbitrary file reads CVE-2021-29475 10.0 CriticalApril 26, 2021
• hedgedoc Stored XSS in slide mode CVE-2021-21259 7.4 HighJanuary 22, 2021
• hedgedoc Stored XSS in mermaid diagrams CVE-2020-26287 8.7 HighDecember 28, 2020
• hedgedoc Arbitary file upload CVE-2020-26286 7.5 HighDecember 28, 2020