CVE-2026-49453: Joplin: Path traversal in resource sync — silent arbitrary file write outside the resource directory
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, Joplin accepts synchronized resource metadata whose id or fileextension contains parent-directory or path-separator characters. BaseItem.unserialize() stores the unvalidated fields, resourceFilename() concatenates them into a destination path, and ResourceFetcher writes the attacker-controlled resource blob outside the resource directory during background synchronization. An attacker with write access to a configured sync target or shared notebook can create or overwrite files at an attacker-chosen existing path without user interaction. This issue is fixed in versions 3.6.15 and 3.7.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
joplinto a version that resolves this vulnerability.Fixed in 3.6.15 - Upgrade
Upgrade
joplinto a version that resolves this vulnerability.Fixed in 3.7.2
Event History
Frequently Asked Questions
Who can exploit this issue in practice?
An attacker needs write access to a configured synchronization target or to a shared notebook. They can supply malicious resource metadata that is processed during a victim's background synchronization.
Is user interaction required for exploitation?
No. The affected client processes the attacker-controlled resource during background synchronization, allowing the write to occur without user interaction.
What versions should be updated?
Update Joplin to version 3.6.15 or 3.7.2. Versions prior to those releases are affected.
What can an attacker do on an affected client?
The attacker can cause a resource blob to be written outside Joplin's resource directory, potentially creating or overwriting an attacker-chosen existing path. The destination is controlled through path-separator or parent-directory characters in synchronized resource metadata.