CVE-2026-49453: Joplin Path Traversal Vulnerability

CVE-2026-49453 Overview

CVE-2026-49453 is a path traversal vulnerability in Joplin, an open source note-taking and to-do application. Versions prior to 3.6.15 and 3.7.2 accept synchronized resource metadata whose id or file_extension fields contain parent-directory or path-separator characters. The BaseItem.unserialize() function stores these unvalidated fields, resourceFilename() concatenates them into a destination path, and ResourceFetcher writes attacker-controlled resource blobs outside the intended resource directory during background synchronization. An attacker with write access to a configured sync target or shared notebook can create or overwrite files at an attacker-chosen path without any user interaction.

Critical Impact
An attacker with sync target write access can overwrite arbitrary files on victim endpoints during background synchronization, enabling code execution or configuration tampering.

Affected Products

Joplin versions prior to 3.6.15
Joplin versions prior to 3.7.2
Joplin desktop, mobile, and CLI clients that synchronize with shared notebooks or sync targets

Discovery Timeline

2026-09-21 - CVE-2026-49453 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-49453

Vulnerability Analysis

The vulnerability is a path traversal flaw classified as [CWE-20] Improper Input Validation. Joplin synchronizes resources (attachments and binary blobs) between clients through a shared sync target such as a WebDAV server, Nextcloud, Dropbox, or a shared notebook. Each resource carries metadata including an id field and a file_extension field. Joplin trusts these values when constructing the on-disk filename for the downloaded blob.

Because the metadata parser does not reject characters like .., /, or \, the resulting path can escape the resource directory. During the background sync cycle, ResourceFetcher writes the attacker-supplied bytes to that computed path. The write requires no user interaction and executes with the privileges of the Joplin process.

Root Cause

The root cause is missing input validation in BaseItem.unserialize(). The function accepts the id and file_extension fields as opaque strings and stores them verbatim. Downstream, resourceFilename() in packages/lib/models/utils/resourceUtils.js concatenates these fields into a filesystem path without sanitization or canonicalization. There is no check to confirm the resulting path stays within the configured resource directory.

Attack Vector

The attacker needs write access to a sync target the victim uses, or membership in a shared notebook. The attacker crafts a resource item whose id or file_extension contains sequences such as ../../../../etc/cron.d/attacker or a Windows path like ..\..\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\payload.lnk. When the victim's client next synchronizes, the malicious blob is written to that location.

text

// Files touched by the security patch
packages/lib/models/utils/resourceUtils.js
packages/lib/models/utils/resourceUtils.test.js
packages/lib/models/utils/types.js

Source: GitHub commit 18e0b08 and GitHub commit 5051807. The patches introduce validation for item IDs during sync and harden the logic that determines resource filenames.

Detection Methods for CVE-2026-49453

Indicators of Compromise

Joplin resource files written outside the configured resources directory under the user profile.
Resource metadata containing .., /, or \ characters in the id or file_extension fields on the sync target.
Unexpected file creation or modification in autostart, cron, or application directories coinciding with Joplin sync activity.
Newly created files whose owning process is the Joplin desktop or CLI binary but whose paths fall outside expected Joplin data folders.

Detection Strategies

Inspect the sync target for resource .md metadata files whose id: line does not match the expected 32-character hex identifier format.
Monitor endpoint file-write telemetry for the Joplin process writing outside %APPDATA%\Joplin, ~/.config/joplin-desktop, or the configured profile path.
Alert on Joplin process writes to sensitive directories such as startup folders, ~/.ssh, ~/.bashrc, or system configuration paths.

Monitoring Recommendations

Enable file integrity monitoring on user autostart locations and shell configuration files on hosts running Joplin.
Log and review sync target contents for malformed resource identifiers on a scheduled basis.
Correlate Joplin sync events with subsequent file creation events using EDR process-lineage data.

How to Mitigate CVE-2026-49453

Immediate Actions Required

Upgrade all Joplin desktop, mobile, and CLI clients to version 3.6.15 or 3.7.2 or later.
Audit shared notebooks and sync target permissions to remove write access from untrusted accounts.
Review existing sync targets for resource metadata files containing path-traversal sequences before allowing clients to sync.

Patch Information

The issue is fixed in Joplin 3.6.15 and 3.7.2. The fixes are delivered in pull request #15540, which rejects malformed item IDs during sync, and pull request #15672, which improves how resource filenames are determined. Full technical detail is available in the GitHub Security Advisory GHSA-r24r-gp6h-cwgf.

Workarounds

Disable synchronization with untrusted or multi-tenant sync targets until clients are patched.
Remove other users from shared notebooks whose contents you cannot fully vouch for.
Run Joplin under a dedicated low-privilege user account to limit the reach of any out-of-directory writes.

bash

# Verify installed Joplin version meets the fixed release
joplin --version
# Expected: 3.6.15, 3.7.2, or later