PT-2025-18289 · Joplin · Joplin

Zonia3000

·

Published

2025-04-30

·

Updated

2025-05-02

·

CVE-2025-27409

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Joplin versions prior to 3.3.3
Description The issue allows path traversal in Joplin Server when the static file path starts with css/pluginAssets or js/pluginAssets. The findLocalFile function in the default route calls localFileFromUrl to check for special pluginAssets paths. If the function returns a path, the result is returned directly, without checking for path traversal, enabling attackers to read files outside the intended directories.
Recommendations For versions prior to 3.3.3, update to version 3.3.3 to resolve the issue. As a temporary workaround, consider restricting access to the css/pluginAssets and js/pluginAssets paths to minimize the risk of exploitation. Avoid using the localFileFromUrl function in the default route until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-27409
GHSA-5XV6-7JM3-FMG5

Affected Products

Joplin