CVE-2026-119764

Name of the Vulnerable Software and Affected Versions Mythic versions 3.2.16 through 3.4.0.61

Description A stored cross-site scripting issue exists where attackers who control files on a target endpoint can execute JavaScript within the Mythic UI origin. This is achieved by placing HTML content inside files with a .pdf extension. When an operator selects Preview Media after downloading such a file, the HTML is rendered as same-origin via the '/direct/view' endpoint due to content-sniffing. This allows the attacker to steal JSON Web Tokens (JWTs) from localStorage, granting full access to GraphQL and REST interfaces.

Recommendations Update Mythic to a version later than 3.4.0.61.