{"id":"CVE-2026-49453","published":"2026-09-21T21:17:03.900","lastModified":"2026-09-21T21:17:03.900","description":"Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, Joplin accepts synchronized resource metadata whose id or file_extension contains parent-directory or path-separator characters. BaseItem.unserialize() stores the unvalidated fields, resourceFilename() concatenates them into a destination path, and ResourceFetcher writes the attacker-controlled resource blob outside the resource directory during background synchronization. An attacker with write access to a configured sync target or shared notebook can create or overwrite files at an attacker-chosen existing path without user interaction. This issue is fixed in versions 3.6.15 and 3.7.2.","cvssScore":7,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L","cwes":["CWE-20","CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://github.com/laurent22/joplin/commit/18e0b08c282c89ae51612c4eff67af2a45ff5163","tags":[]},{"url":"https://github.com/laurent22/joplin/commit/50518073740c4501058e366300b42c2f1925cb05","tags":[]},{"url":"https://github.com/laurent22/joplin/pull/15540","tags":[]},{"url":"https://github.com/laurent22/joplin/pull/15672","tags":[]},{"url":"https://github.com/laurent22/joplin/security/advisories/GHSA-r24r-gp6h-cwgf","tags":[]}],"exploitRefs":[{"url":"https://github.com/laurent22/joplin/commit/18e0b08c282c89ae51612c4eff67af2a45ff5163","tags":[]},{"url":"https://github.com/laurent22/joplin/commit/50518073740c4501058e366300b42c2f1925cb05","tags":[]},{"url":"https://github.com/laurent22/joplin/pull/15540","tags":[]},{"url":"https://github.com/laurent22/joplin/pull/15672","tags":[]},{"url":"https://github.com/laurent22/joplin/security/advisories/GHSA-r24r-gp6h-cwgf","tags":[]}],"hasPoc":true,"ai":{"summary":"Joplin allows attackers to write files outside the intended directory due to unvalidated resource metadata, posing a risk of data leakage or corruption.","exploitability":"Exploitation requires write access to a sync target or shared notebook and knowledge of file paths; moderate effort needed.","blast_radius":"If exploited, could lead to unauthorized file modifications on the system where Joplin is installed.","remediation":"Update Joplin to version 3.6.15 or later to mitigate this vulnerability.","tags":["file-write","sync-vuln","note-taking"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-22T06:18:28.196Z"}}