---
id: CVE-2026-119764
title: Mythic 3.2.16 through 3.4.0.61 Stored XSS via Agent-Downloaded File Preview
summary: >-
  Mythic 3.2.16 through 3.4.0.61 contains a stored cross-site scripting
  vulnerability that allows attackers controlling target endpoint files to run
  JavaScript in the Mythic UI origin by planting HTML in .pdf-named files. When
  an operator …
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: its-a-feature
product: Mythic
affected:
  - Mythic >= 3.2.16 <= 3.4.0.61
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-05T02:26:48.229202Z'
exploitAvailable: true
published: '2026-10-30'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T02:27:10.275Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119764'
references:
  - url: 'https://github.com/h00die/mythic_xss'
  - url: >-
      https://github.com/its-a-feature/Mythic/commit/f06b3ed2d1de6577744cc0b3146966c625685859
  - url: >-
      https://github.com/its-a-feature/Mythic/blob/33a46d7db7e237458d7e20e7d3cfefef8112e590/MythicReactUI/src/components/pages/Callbacks/ResponseDisplayMedia.js#L335-L336
  - url: 'https://github.com/its-a-feature/Mythic'
  - url: >-
      https://www.vulncheck.com/advisories/mythic-3.2.16-through-3.4.0.61-stored-xss-via-agent-downloaded-file-preview
    label: >-
      VulnCheck Advisory: Mythic 3.2.16 through 3.4.0.61 Stored XSS via
      Agent-Downloaded File Preview
tags:
  - cve.org
  - exploit-available
epss: 0.00317
epssPercentile: 0.2474
ingestedAt: '2026-11-05T21:36:00.692Z'
---

## Overview

Mythic 3.2.16 through 3.4.0.61 contains a stored cross-site scripting vulnerability that allows attackers controlling target endpoint files to run JavaScript in the Mythic UI origin by planting HTML in .pdf-named files. When an operator downloads the file and clicks Preview Media, content-sniffed HTML from /direct/view renders same-origin, stealing localStorage JWTs for full GraphQL and REST access.

## Affected

- `Mythic >= 3.2.16 <= 3.4.0.61`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.