{"id":"CVE-2026-42564","aliases":["EUVD-2026-29329","GHSA-7843-gwq8-g96f"],"status":"published","title":"jotty·page: Unauthenticated Path Traversal leads to sensitive file disclosure and session-token reuse impact","description":"jotty·page is a self-hosted app for your checklists and notes. Prior to 1.22.0, an unauthenticated path traversal vulnerability exists in /api/app-icons/[filename]. The filename route parameter is joined into a filesystem path without traversal/boundary validation, allowing file reads outside data/uploads/app-icons/. This vulnerability is fixed in 1.22.0.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01157,"percentile":0.67465,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200","CWE-22"],"published":"2026-05-11T21:17:41Z","modified":"2026-10-28T02:30:34Z","exploits":[{"source":"nuclei","id":"CVE-2026-42564","title":"jotty.page \u003c 1.22.0 - Path Traversal","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-42564.yaml"}],"products":[{"vendor":"fccview","product":"jotty"}],"references":[{"url":"https://github.com/fccview/jotty/security/advisories/GHSA-7843-gwq8-g96f","tags":["x_refsource_CONFIRM","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42564.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42564","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-42564","title":"jotty·page: Unauthenticated Path Traversal leads to sensitive file disclosure and session-token reuse impact","description":"jotty·page is a self-hosted app for your checklists and notes. Prior to 1.22.0, an unauthenticated path traversal vulnerability exists in /api/app-icons/[filename]. The filename route parameter is joined into a filesystem path without traversal/boundary validation, allowing file reads outside data/uploads/app-icons/. This vulnerability is fixed in 1.22.0.","status":"published","published":"2026-05-11T21:17:41.624Z","modified":"2026-05-12T16:40:55.181Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-22","CWE-200"],"updated_at":"2026-11-02T13:40:23.731501Z"}],"euvd":[{"id":"EUVD-2026-29329","description":"jotty·page is a self-hosted app for your checklists and notes. Prior to 1.22.0, an unauthenticated path traversal vulnerability exists in /api/app-icons/[filename]. The filename route parameter is joined into a filesystem path without traversal/boundary validation, allowing file reads outside data/uploads/app-icons/. This vulnerability is fixed in 1.22.0.","status":"published","published":"2026-05-11T21:17:41Z","modified":"2026-05-12T16:40:55Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T19:04:37.152927Z"}],"nvd":[{"id":"CVE-2026-42564","description":"jotty·page is a self-hosted app for your checklists and notes. Prior to 1.22.0, an unauthenticated path traversal vulnerability exists in /api/app-icons/[filename]. The filename route parameter is joined into a filesystem path without traversal/boundary validation, allowing file reads outside data/uploads/app-icons/. This vulnerability is fixed in 1.22.0.","status":"published","published":"2026-05-11T22:22:11.417Z","modified":"2026-10-26T18:10:00.173Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-22","CWE-200"],"updated_at":"2026-11-02T14:12:18.239974Z"}],"osv":[{"id":"CVE-2026-42564","title":"jotty·page: Unauthenticated Path Traversal leads to sensitive file disclosure and session-token reuse impact","description":"jotty·page is a self-hosted app for your checklists and notes. Prior to 1.22.0, an unauthenticated path traversal vulnerability exists in /api/app-icons/[filename]. The filename route parameter is joined into a filesystem path without traversal/boundary validation, allowing file reads outside data/uploads/app-icons/. This vulnerability is fixed in 1.22.0.","status":"published","published":"2026-05-11T21:17:41.624Z","modified":"2026-10-28T02:30:34.665677319Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-200","CWE-22"],"updated_at":"2026-11-02T15:45:04.117819Z"}]}}