PT-2026-41386 · Joplin · Joplin

Msiemens · Published 2026-05-15 · Updated 2026-05-19 · CVE-2026-22810

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Joplin versions prior to 3.5.7

Description A path traversal issue exists in the OneNote importer. The OneNote converter fails to sanitize the names of embedded files before writing them to disk. An attacker can create a malicious .one file containing file names with ../../ sequences, which are interpreted as part of the target path during attachment extraction. This allows the overwriting of arbitrary files on disk, which could potentially lead to remote code execution. The determine filename() function in embedded file.rs is specifically involved as it passes through the provided file name without validation.

Recommendations Update to version 3.5.7.

Exploit

Fix

Weakness Enumeration

CWE-24

Related Identifiers

CVE-2026-22810

GHSA-GCMJ-C9GG-9VH6

Affected Products

Joplin

References · 15

• 🔥 https://github.com/laurent22/joplin/security/advisories/GHSA-gcmj-c9gg-9vh6 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22810.json · Exploit
• https://github.com/laurent22/joplin/releases/tag/v3.5.7 · Patch
• https://github.com/laurent22/joplin/commit/791668455e1aae50501ff57ea4783b3fba9d377c · Patch
• https://osv.dev/vulnerability/GHSA-gcmj-c9gg-9vh6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-22810 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22810 · Security Note
• https://github.com/laurent22/joplin/pull/13736 · Note
• https://github.com/laurent22/joplin/blob/af5108d70233b1db9410346958c1587cf7c1b16d/packages/onenote-converter/renderer/src/page/embedded_file.rs#L13-L16 · Note
• https://github.com/laurent22/joplin · Note
• https://t.me/cveNotify/163926 · Telegram Post
• https://twitter.com/infoflowcloud/status/2056671592663417329 · Twitter Post
• https://twitter.com/CVEnew/status/2056670127278723566 · Twitter Post
• https://t.me/CVEtracker/54170 · Telegram Post
• https://twitter.com/ADKCyber/status/2056810266898116913 · Twitter Post