CVE-2018-6806

MEDIUM 6.5CVE-2018-6806 · Published 07/02/2018 · updated 17/06/2026

In short

CVE-2018-6806 is a MEDIUM (CVSS 6.5) vulnerability affecting marked 2 (marked 2 project).
Chance of exploitation in the next 30 days (EPSS): 1.2%, higher than 68.3% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
marked 2 marked_2_project	`≤ 2.5.11`	No fix yet

Description

Marked 2 through 2.5.11 allows remote attackers to read arbitrary files via a crafted HTML document that triggers a redirect to an x-marked://preview?text= URL. The value of the text parameter can include arbitrary JavaScript code, e.g., making XMLHttpRequest calls.

References

support.markedapp.com/discussions/questions/9089-reporting-a-vulnerability · Issue Tracking
lynxsecurity.io/releases/Local%20File%20Disclosure%20in%20Marked2.pdf · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free