CVE-2026-49453

7 HIGHpublic exploit available

Published 2026-09-21 · Updated 2026-09-23

AI risk analysis

Summary: Joplin allows attackers to write files outside the intended directory due to unvalidated resource metadata, posing a risk of data leakage or corruption.
Exploitability: Exploitation requires write access to a sync target or shared notebook and knowledge of file paths; moderate effort needed.
Blast radius: If exploited, could lead to unauthorized file modifications on the system where Joplin is installed.
Prioritized remediation: Update Joplin to version 3.6.15 or later to mitigate this vulnerability.

file-writesync-vulnnote-taking

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, Joplin accepts synchronized resource metadata whose id or file_extension contains parent-directory or path-separator characters. BaseItem.unserialize() stores the unvalidated fields, resourceFilename() concatenates them into a destination path, and ResourceFetcher writes the attacker-controlled resource blob outside the resource directory during background synchronization. An attacker with write access to a configured sync target or shared notebook can create or overwrite files at an attacker-chosen existing path without user interaction. This issue is fixed in versions 3.6.15 and 3.7.2.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L

Weaknesses

CWE-20, CWE-22

Public exploit & PoC references

References

Data: NVD (public domain). Analysis: local $0 model. Defensive use only.