Path Traversal Vulnerability in Joplin Note-Taking Application

CVE-2026-22810

What is CVE-2026-22810?

The Joplin note-taking and to-do application is susceptible to a path traversal vulnerability due to improper sanitization of embedded file names in its OneNote converter. Versions before 3.5.7 allow attackers to exploit this flaw by crafting malicious .one files that can overwrite arbitrary files on the disk. This is accomplished through file names that include sequences like '../../', which the application interprets as part of the file path during extraction of attachments. Users are strongly encouraged to upgrade to version 3.5.7 or later to mitigate this risk.

References