---
id: "CVE-2026-119764"
kind: "vulnerability"
aliases: ["CVE-2026-119764"]
title: "Mythic C2 UI: planted HTML in PDF-named files steals operator logins"
severity: "high"
cvss: 7.4
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Mythic", "fixed": [], "affected": ">= 3.2.16, <= 3.4.0.61", "ecosystem": "other"}]
ecosystems: []
tags: ["c2-frameworks", "mythic", "other", "red-team", "self-hosted", "xss"]
not_affected_if: ["version-outside-range"]
published_at: "2026-10-30T18:17:27+00:00"
first_seen_at: "2026-10-30T18:55:29+00:00"
updated_at: "2026-10-30T18:58:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119764", "first_seen_at": "2026-10-30T18:55:29+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-30T18:58:15+00:00"}]
---

# Mythic C2 UI: planted HTML in PDF-named files steals operator logins

Mythic, a command-and-control framework, has a stored cross-site scripting flaw in versions 3.2.16 through 3.4.0.61. An attacker who controls files on a target endpoint can plant HTML disguised as a PDF, and when an operator clicks Preview Media the script runs in the Mythic UI and reads localStorage JWTs, giving full GraphQL and REST access.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- other:Mythic affected >= 3.2.16, <= 3.4.0.61 fixed ?

## How to check

Run mythic-cli version (or check the Mythic release/tag you deployed) and compare to 3.2.16 through 3.4.0.61. If you are in the range, treat any file downloaded from an agent as untrusted and do not click Preview Media on it (it is served from /direct/view in the UI origin). A build that includes upstream commit f06b3ed2 should have the fix; confirm in the repo.

## Fix

No fixed release confirmed. Upstream commit f06b3ed2d1de6577744cc0b3146966c625685859 is referenced by the advisory; update to a Mythic release containing it once published.

## Timeline

- 2026-10-30T18:55:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119764
- 2026-10-30T18:58:15+00:00 analyst — VulnCheck (CNA) advisory read: affected Mythic >=3.2.16 <=3.4.0.61, CWE-79, vulnerable code ResponseDisplayMedia.js L335-336, fix commit f06b3ed referenced and a public PoC repo h00die/mythic_xss linked, but I could not read either page, and no release with the fix is confirmed (releases page I got looked stale). Fixed version unknown; nothing verified.

## Documents

- [advisory] VulnCheck: Mythic 3.2.16 through 3.4.0.61 Stored XSS via Agent-Downloaded File Preview https://www.vulncheck.com/advisories/mythic-3.2.16-through-3.4.0.61-stored-xss-via-agent-downloaded-file-preview
- [fix] Mythic commit f06b3ed (referenced by advisory; content not read) https://github.com/its-a-feature/Mythic/commit/f06b3ed2d1de6577744cc0b3146966c625685859
- [poc] h00die/mythic_xss (referenced; not read) https://github.com/h00die/mythic_xss

## From the sources

Mythic 3.2.16 through 3.4.0.61 contains a stored cross-site scripting vulnerability that allows attackers controlling target endpoint files to run JavaScript in the Mythic UI origin by planting HTML in .pdf-named files. When an operator downloads the file and clicks Preview Media, content-sniffed HTML from /direct/view renders same-origin, stealing localStorage JWTs for full GraphQL and REST access.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_