CVE-2020-26286

HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an unauthenticated attacker can upload arbitrary files to the upload storage backend including HTML, JS and PHP files. The problem is patched in HedgeDoc 1.7.1. You should however verify that your uploaded file storage only contains files that are allowed, as uploaded files might still be served. As workaround it's possible to block the `/uploadimage` endpoint on your instance using your reverse proxy. And/or restrict MIME-types and file names served from your upload file storage.

• CWE-434

• https://github.com/hedgedoc/hedgedoc/commit/e9306991cdb5ff2752c1eeba3fedba42aec3c2d8Patch, Third Party Advisory
• https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.1Third Party Advisory
• https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-wcr3-xhv7-8gxcThird Party Advisory
• https://github.com/hedgedoc/hedgedoc/commit/e9306991cdb5ff2752c1eeba3fedba42aec3c2d8Patch, Third Party Advisory
• https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.1Third Party Advisory
• https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-wcr3-xhv7-8gxcThird Party Advisory

Published

Dec 29, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-26280OpenSlides is a free, Web-based presentation and assembly sy…8.9
• CVE-2020-26281async-h1 is an asynchronous HTTP/1.1 parser for Rust (crates…7.5
• CVE-2020-26282BrowserUp Proxy allows you to manipulate HTTP requests and r…10
• CVE-2020-26283go-ipfs is an open-source golang implementation of IPFS whic…8.8
• CVE-2020-26284Hugo is a fast and Flexible Static Site Generator built in G…8.5
• CVE-2020-26285OpenMage is a community-driven alternative to Magento CE. In…7.2
• CVE-2020-26287HedgeDoc is a collaborative platform for writing and sharing…8.7
• CVE-2020-26288Parse Server is an open source backend that can be deployed …6.5
• CVE-2020-26289date-and-time is an npm package for manipulating date and ti…7.5
• CVE-2020-2629Vulnerability in the Enterprise Manager Base Platform produc…6
• CVE-2020-26290Dex is a federated OpenID Connect provider written in Go. In…9.6
• CVE-2020-26291URI.js is a javascript URL mutation library (npm package uri…6.5