CVE-2026-49453
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
Joplin, an open source note-taking and to-do application, prior to versions 3.6.15 and 3.7.2, accepts synchronized resource metadata whose id or file_extension contains parent-directory or path-separator characters. During background synchronization, ResourceFetcher writes the attacker-controlled resource blob outside the resource directory, allowing creation or overwriting of files at an attacker-chosen existing path.
Risk Assessment
An attacker with write access to a configured sync target or shared notebook can create or overwrite files on the system, potentially leading to data integrity compromise or further compromise.
Recommendation
Update Joplin to versions 3.6.15 or 3.7.2, which contain the fix. Restrict access to sync targets and shared notebooks.
Other vulnerabilities in Joplin
See all- CVE-2022-35131Critical
Joplin version 2.8.8 contains a vulnerability that allows arbitrary command execution. The attack is performed by injecting a crafted payload into note titles.
- CVE-2026-46650Medium
Prior to 3.7.2, isAcceptedUrl() in packages/renderer/htmlUtils.ts uses an unanchored regular expression for internal resource URLs, allowing a javascript: URL containing a matching 32-character path fragment to pass validation and be emitted into an HTML note's link. A low-privileged Joplin Server user can publish the crafted HTML note as a public share; in the current build ordinary left-click is blocked, and demonstrated execution requires middle-click or Open in new tab in an older or non-hardened browser.
- CVE-2026-55105High
Joplin, an open source note-taking and to-do application, prior to versions 3.6.15 and 3.7.2, passes HTML generated by the vendored fountain.js renderer into note output without sanitizing it. A malicious Fountain code block can execute script when Fountain rendering is enabled in desktop or mobile clients, or when a note is published through Joplin Server where Fountain rendering is enabled by default.
- CVE-2026-49449Low
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. From 1.4.0 until 3.7.2, packages/renderer/MdToHtml/rules/katex.ts enables KaTeX's trust option for note content, allowing a note author to place a \href URL into rendered output without passing Joplin's normal URL allowlist. On Windows, clicking a link whose target is an attacker-controlled UNC path causes pathExists() to initiate SMB authentication and disclose the current user's NTLMv2 challenge-response without a warning. The unfiltered URL can also invoke other registered URL handlers, but the credential disclosure through KaTeX \href is the distinguishing demonstrated impact. This issue is fixed in version 3.7.2.
- CVE-2026-34600Medium
Joplin versions 3.5.2 and earlier contain a logic error in the delta API that allows share recipients to download notes that are no longer shared with them. The flaw stems from improper filtering of item state and change compression, leading to data leakage.
- CVE-2025-57798Medium
Joplin, an open-source note-taking and to-do application, versions 3.6.14 and prior, contains a Denial of Service (DoS) vulnerability in the note title input due to missing length validation. An attacker can cause an Out Of Memory (OOM) error and program termination by inserting an excessively long string into a note's title, either via the UI or through the local web service API (port 41184) after compromising an authentication token. The issue is fixed in version 3.7.1.
- CVE-2026-22810High
Joplin prior to version 3.5.7 contains a path traversal vulnerability in the importer, allowing arbitrary file overwrite. The OneNote converter does not sanitize embedded file names, enabling ../.. sequences.
- CVE-2023-37299Medium
Joplin before 2.11.5 allows XSS via an AREA element of an image map.
- CVE-2023-37298Medium
Joplin versions before 2.11.5 allow XSS via a USE element in an SVG document.
Original NVD description (English source)
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, Joplin accepts synchronized resource metadata whose id or file_extension contains parent-directory or path-separator characters. BaseItem.unserialize() stores the unvalidated fields, resourceFilename() concatenates them into a destination path, and ResourceFetcher writes the attacker-controlled resource blob outside the resource directory during background synchronization. An attacker with write access to a configured sync target or shared notebook can create or overwrite files at an attacker-chosen existing path without user interaction. This issue is fixed in versions 3.6.15 and 3.7.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS