CVE-2026-42564: jotty·page Path Traversal Vulnerability

CVE-2026-42564 Overview

CVE-2026-42564 is an unauthenticated path traversal vulnerability in jotty·page, a self-hosted application for checklists and notes. The flaw exists in the /api/app-icons/[filename] endpoint, where the filename route parameter is joined into a filesystem path without traversal or boundary validation. Attackers can read files outside the intended data/uploads/app-icons/ directory without authentication. The issue affects all versions prior to 1.22.0 and is classified under [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact

Unauthenticated remote attackers can read arbitrary files from the host filesystem accessible to the jotty·page process, exposing configuration files, secrets, and other sensitive data.

Affected Products

• jotty·page versions prior to 1.22.0
• Self-hosted deployments exposing the /api/app-icons/[filename] endpoint
• All operating systems running affected jotty·page builds

Discovery Timeline

• 2026-05-11 - CVE-2026-42564 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-42564

Vulnerability Analysis

The vulnerability resides in the /api/app-icons/[filename] route handler. The application accepts a user-supplied filename parameter and joins it directly to the application's icon storage directory using standard path-joining logic. Because the joined path is not normalized or validated against the intended base directory, an attacker can supply traversal sequences such as ../ to escape the data/uploads/app-icons/ boundary.

The endpoint requires no authentication, so any network-reachable attacker can issue HTTP requests to retrieve arbitrary files. Read access is limited to files accessible to the user account running the jotty·page service. The EPSS score is 0.066% (percentile 20.45) as of 2026-05-17, reflecting limited current exploitation prediction despite straightforward exploitability.

Root Cause

The root cause is missing boundary enforcement after path concatenation. The handler does not call a containment check such as resolving the candidate path and verifying it starts with the canonical base directory. This omission permits relative traversal segments to resolve outside the upload directory.

Attack Vector

An attacker sends an HTTP GET request to /api/app-icons/ with traversal sequences in place of a legitimate filename. The server resolves the path, reads the target file, and returns its contents in the response. No credentials, user interaction, or prior access are required. For technical details and the patch commit, see the GitHub Security Advisory GHSA-7843-gwq8-g96f.

Detection Methods for CVE-2026-42564

Indicators of Compromise

• HTTP requests to /api/app-icons/ containing ../, ..%2F, ..%5C, or URL-encoded traversal sequences in the filename segment
• Requests to /api/app-icons/ resolving to filenames that do not match icons stored in data/uploads/app-icons/
• Unusual response sizes from the app-icons endpoint inconsistent with image file payloads

Detection Strategies

• Inspect web server and reverse proxy logs for traversal patterns targeting the /api/app-icons/ route
• Deploy web application firewall (WAF) rules that block path traversal payloads against jotty·page endpoints
• Correlate anomalous access patterns to the icon endpoint with reads of sensitive system files such as /etc/passwd or application configuration files

Monitoring Recommendations

• Enable verbose access logging on the jotty·page reverse proxy and forward logs to a centralized analytics platform
• Alert on repeated 200 responses from /api/app-icons/ requests with non-image content types
• Monitor outbound data volumes from the jotty·page host to identify potential file exfiltration

How to Mitigate CVE-2026-42564

Immediate Actions Required

• Upgrade jotty·page to version 1.22.0 or later, which contains the official fix
• Restrict network exposure of the jotty·page service to trusted networks or authenticated reverse proxies until patching is complete
• Audit logs for prior exploitation attempts targeting /api/app-icons/

Patch Information

The maintainers fixed the vulnerability in jotty·page 1.22.0 by adding traversal and boundary validation on the filename route parameter. Refer to the GitHub Security Advisory GHSA-7843-gwq8-g96f for release notes and remediation guidance.

Workarounds

• Place a reverse proxy in front of jotty·page and block requests where the path after /api/app-icons/ contains .., %2e%2e, or encoded backslashes
• Run jotty·page as a low-privilege user with filesystem permissions limited to its data directory to reduce the impact of arbitrary file reads
• Restrict access to the application using network-level controls such as VPN or IP allowlists until the upgrade is applied

# Example NGINX rule to block traversal sequences on the app-icons endpoint
location ~* ^/api/app-icons/ {
    if ($request_uri ~* "(\.\./|\.\.%2f|%2e%2e/|%2e%2e%2f)") {
        return 403;
    }
    proxy_pass http://jotty_upstream;
}