SZB-82cd623714
EUVD-2026-114241: Mythic stored XSS reported via HTML planted in .pdf-named files
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- its-a-feature
- Product
- Mythic
- First seen
Summary
The EUVD listing (CVSS 7.4) says Mythic 3.2.16 through 3.4.0.61 has a stored cross-site scripting flaw that lets attackers controlling target endpoint files run JavaScript in the Mythic UI origin by planting HTML in .pdf-named files. The listing is the only source cited.
If you use its-a-feature
Upgrade Mythic to a version later than 3.4.0.61
Avoid downloading untrusted files through the Mythic UI until patched
Review operator sessions for unexpected activity
What the sources say 1
· Mastodon: “Mythic 3.2.16 through 3.4.0.61 contains a stored cross-site scripting vulnerability that allows attackers controlling target endpoint files to run JavaScript in the Mythic UI origin by planting HTML in .pdf-named files.” Source