CVE-2026-22810
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Joplin prior to version 3.5.7 contains a path traversal vulnerability in the importer, allowing arbitrary file overwrite. The OneNote converter does not sanitize embedded file names, enabling ../.. sequences.
Risk Assessment
An attacker could overwrite critical system or configuration files, potentially leading to application or system compromise.
Recommendation
Upgrade Joplin to version 3.5.7 or later.
Other vulnerabilities in Joplin
See all- CVE-2022-35131Critical
Joplin version 2.8.8 contains a vulnerability that allows arbitrary command execution. The attack is performed by injecting a crafted payload into note titles.
- CVE-2026-34600Medium
Joplin versions 3.5.2 and earlier contain a logic error in the delta API that allows share recipients to download notes that are no longer shared with them. The flaw stems from improper filtering of item state and change compression, leading to data leakage.
- CVE-2025-57798Medium
Joplin, an open-source note-taking and to-do application, versions 3.6.14 and prior, contains a Denial of Service (DoS) vulnerability in the note title input due to missing length validation. An attacker can cause an Out Of Memory (OOM) error and program termination by inserting an excessively long string into a note's title, either via the UI or through the local web service API (port 41184) after compromising an authentication token. The issue is fixed in version 3.7.1.
- CVE-2023-37299Medium
Joplin before 2.11.5 allows XSS via an AREA element of an image map.
- CVE-2023-37298Medium
Joplin versions before 2.11.5 allow XSS via a USE element in an SVG document.
Original NVD description (English source)
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions prior to 3.5.7 contain a path traversal vulnerability in the importer which allows overwriting arbitrary files on disk. The OneNote converter does not sanitize the names of embedded files before writing them to disk. As a result, it's possible for an attacker to create a malicious .one file that includes file names containing ../../, that are then interpreted as part of the target path when extracting attachments from the .one file. This issue has been patched in version 3.5.7.