CVE-2025-27409 Joplin Server Vulnerable to Path Traversal
Attackers can read arbitrary files outside intended directories in Joplin Server due to insufficient path validation in plugin asset handling.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-27409?
CVE-2025-27409 is a high-severity path traversal vulnerability in laurent22 joplin, published on 30 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, path traversal is possible in Joplin Server if static file path starts with `css/pluginAssets` or `js/pluginAssets`. The `findLocalFile` function in the `default route` calls `localFileFromUrl` to check for special `pluginAssets` paths. If the function returns a path, the result is returned directly, without checking for path traversal. The vulnerability allows attackers to read files outside the intended directories. This issue has been patched in version 3.3.3.
Weakness: CWE-22
Which versions are affected by CVE-2025-27409?
It affects 1 product.
Products include Joplin Project Joplin.
How do I fix CVE-2025-27409?
No fix has been published for CVE-2025-27409 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-27409 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-27409 exists.
Other vulnerabilities in laurent22 joplin
- CVE-2022-23340 Joplin Vulnerable to Code Injection
- CVE-2024-40643 Joplin has a parsing error leading to Cross-site Scripting (XSS)
- CVE-2023-45673 Arbitrary code execution on click of PDF links in Joplin
- CVE-2025-27134 Privilege escalation in Joplin server via user patch endpoint
- CVE-2023-37898 Safe mode Cross-site Scripting (XSS) vulnerability in Joplin
Sources
Also known as GHSA-5xv6-7jm3-fmg5.