RCE Vulnerability in Joplin Server Prior to Version 3.7.7

CVE-2026-59814

What is CVE-2026-59814?

Joplin, a popular open-source note-taking and to-do application, has a vulnerability in its server prior to version 3.7.7 that could lead to remote code execution. An attacker can exploit this flaw by crafting a malicious resource with a user-controlled mime type, bypassing security measures when the resource title is empty. This allows low-privileged users to publish empty-title attachments which execute scripts upon access. If a victim opens the affected public share, the script can manipulate data and perform unauthorized actions using the victim’s session, particularly accessing sensitive data and administrative tokens. Even when USER_CONTENT_BASE_URL is set to a separate origin, the vulnerability allows scripts to execute on that origin. It is crucial for users to upgrade to version 3.7.7 to mitigate this risk.

References