CVE-2026-25642

CVE-2026-25642 is a medium-severity vulnerability affecting HedgeDoc, an open-source collaborative markdown notes application, specifically versions prior to 1.10.6. The flaw stems from an overly permissive Content-Security-Policy for files served under the /uploads/ endpoint, allowing attackers to host malicious interactive web content, such as fake login forms, within SVG files. This vulnerability has a CVSS score of 6.1 and could lead to information disclosure and integrity impacts if a user is tricked into interacting with malicious content. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.