Joplin vulnerabilities

Joplin version 2.8.8 contains a vulnerability that allows arbitrary command execution. The attack is performed by injecting a crafted payload into note titles.

Joplin versions 3.5.2 and earlier contain a logic error in the delta API that allows share recipients to download notes that are no longer shared with them. The flaw stems from improper filtering of item state and change compression, leading to data leakage.

Joplin, an open-source note-taking and to-do application, versions 3.6.14 and prior, contains a Denial of Service (DoS) vulnerability in the note title input due to missing length validation. An attacker can cause an Out Of Memory (OOM) error and program termination by inserting an excessively long string into a note's title, either via the UI or through the local web service API (port 41184) after compromising an authentication token. The issue is fixed in version 3.7.1.

Joplin prior to version 3.5.7 contains a path traversal vulnerability in the importer, allowing arbitrary file overwrite. The OneNote converter does not sanitize embedded file names, enabling ../.. sequences.

Joplin before 2.11.5 allows XSS via an AREA element of an image map.

Joplin versions before 2.11.5 allow XSS via a USE element in an SVG document.