CVE-2026-59816: Joplin: Path traversal in transcribe proxy endpoint via URL-encoded slash
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, the GET /api/transcribe/:id and POST /api/transcribe/:id handlers in packages/server/src/routes/api/transcribe.ts on Joplin Server instances with TRANSCRIBEENABLED=true pass the decoded id directly into transcription backend URLs. An authenticated user can place URL-encoded slash and parent-directory segments in the job ID, causing parseSubPath() to decode a path that escapes the intended /transcribe/ prefix. The server then proxies the request to other transcription-backend endpoints and can return their responses, potentially exposing internal administrative, health, or configuration data. This issue is fixed in version 3.7.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Joplin Server (/api/transcribe/:id handlers)to a version that resolves this vulnerability.Fixed in 3.7.7
Event History
Frequently Asked Questions
Which deployments are exposed?
Joplin Server instances running a version earlier than 3.7.7 are affected when TRANSCRIBE_ENABLED is set to true. Instances without that feature enabled are not described as exposed.
What access does an attacker need?
An attacker needs an authenticated Joplin user account. They can exploit the GET or POST transcribe API handler by supplying a job ID containing URL-encoded slashes and parent-directory segments.
What could an attacker access?
The flaw can cause the server to proxy requests beyond the intended transcription path to other transcription-backend endpoints. Responses from internal administrative, health, or configuration endpoints may be returned to the attacker.
What should be done if upgrading cannot happen immediately?
Disable transcription by setting TRANSCRIBE_ENABLED to false until Joplin Server can be updated to version 3.7.7 or later.