CVE-2026-119764

Mythic versions 3.2.16 through 3.4.0.61 are vulnerable to a stored cross-site scripting (XSS) flaw. Attackers who control files on a target endpoint can plant HTML within .pdf-named files . If an operator downloads such a file and selects Preview Media , the system renders content-sniffed HTML fr...