{"id":"CVE-2026-49453","aliases":["EUVD-2026-84167","GHSA-r24r-gp6h-cwgf"],"status":"published","title":"Joplin: Path traversal in resource sync — silent arbitrary file write outside the resource directory","description":"Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, Joplin accepts synchronized resource metadata whose id or file_extension contains parent-directory or path-separator characters. BaseItem.unserialize() stores the unvalidated fields, resourceFilename() concatenates them into a destination path, and ResourceFetcher writes the attacker-controlled resource blob outside the resource directory during background synchronization. An attacker with write access to a configured sync target or shared notebook can create or overwrite files at an attacker-chosen existing path without user interaction. This issue is fixed in versions 3.6.15 and 3.7.2.","severity":{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0041,"percentile":0.35555,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-20","CWE-22"],"published":"2026-09-21T20:50:28Z","modified":"2026-10-28T02:30:52Z","products":[{"vendor":"laurent22","product":"joplin"}],"references":[{"url":"https://github.com/laurent22/joplin/security/advisories/GHSA-r24r-gp6h-cwgf","tags":["x_refsource_CONFIRM","exploit","advisory"]},{"url":"https://github.com/laurent22/joplin/pull/15540","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/laurent22/joplin/pull/15672","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/laurent22/joplin/commit/18e0b08c282c89ae51612c4eff67af2a45ff5163","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/laurent22/joplin/commit/50518073740c4501058e366300b42c2f1925cb05","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49453.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49453","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-49453","title":"Joplin: Path traversal in resource sync — silent arbitrary file write outside the resource directory","description":"Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, Joplin accepts synchronized resource metadata whose id or file_extension contains parent-directory or path-separator characters. BaseItem.unserialize() stores the unvalidated fields, resourceFilename() concatenates them into a destination path, and ResourceFetcher writes the attacker-controlled resource blob outside the resource directory during background synchronization. An attacker with write access to a configured sync target or shared notebook can create or overwrite files at an attacker-chosen existing path without user interaction. This issue is fixed in versions 3.6.15 and 3.7.2.","status":"published","published":"2026-09-21T20:50:28.455Z","modified":"2026-09-22T13:31:37.953Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-20","CWE-22"],"updated_at":"2026-11-02T13:35:10.963527Z"}],"euvd":[{"id":"EUVD-2026-84167","description":"Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, Joplin accepts synchronized resource metadata whose id or file_extension contains parent-directory or path-separator characters. BaseItem.unserialize() stores the unvalidated fields, resourceFilename() concatenates them into a destination path, and ResourceFetcher writes the attacker-controlled resource blob outside the resource directory during background synchronization. An attacker with write access to a configured sync target or shared notebook can create or overwrite files at an attacker-chosen existing path without user interaction. This issue is fixed in versions 3.6.15 and 3.7.2.","status":"published","published":"2026-09-21T20:50:28Z","modified":"2026-09-22T13:31:37Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T17:28:03.363938Z"}],"nvd":[{"id":"CVE-2026-49453","description":"Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, Joplin accepts synchronized resource metadata whose id or file_extension contains parent-directory or path-separator characters. BaseItem.unserialize() stores the unvalidated fields, resourceFilename() concatenates them into a destination path, and ResourceFetcher writes the attacker-controlled resource blob outside the resource directory during background synchronization. An attacker with write access to a configured sync target or shared notebook can create or overwrite files at an attacker-chosen existing path without user interaction. This issue is fixed in versions 3.6.15 and 3.7.2.","status":"published","published":"2026-09-21T21:17:03.9Z","modified":"2026-09-23T18:30:42.573Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-20","CWE-22"],"updated_at":"2026-11-02T14:12:50.368368Z"}],"osv":[{"id":"CVE-2026-49453","title":"Joplin: Path traversal in resource sync — silent arbitrary file write outside the resource directory","description":"Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, Joplin accepts synchronized resource metadata whose id or file_extension contains parent-directory or path-separator characters. BaseItem.unserialize() stores the unvalidated fields, resourceFilename() concatenates them into a destination path, and ResourceFetcher writes the attacker-controlled resource blob outside the resource directory during background synchronization. An attacker with write access to a configured sync target or shared notebook can create or overwrite files at an attacker-chosen existing path without user interaction. This issue is fixed in versions 3.6.15 and 3.7.2.","status":"published","published":"2026-09-21T20:50:28.455Z","modified":"2026-10-28T02:30:52.376580127Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L","level":"high"}],"cwes":["CWE-20","CWE-22"],"updated_at":"2026-11-02T15:45:07.060148Z"}]}}