CVE-2026-49453 Joplin: Path traversal in resource sync — silent arbitrary file write outside the resource directory
An attacker with sync target access can write arbitrary files outside the resource directory via path traversal in Joplin, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-49453?
CVE-2026-49453 is a high-severity path traversal vulnerability in laurent22 joplin, published on 21 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, Joplin accepts synchronized resource metadata whose id or file_extension contains parent-directory or path-separator characters. BaseItem.unserialize() stores the unvalidated fields, resourceFilename() concatenates them into a destination path, and ResourceFetcher writes the attacker-controlled resource blob outside the resource directory during background synchronization. An attacker with write access to a configured sync target or shared notebook can create or overwrite files at an attacker-chosen existing path without user interaction. This issue is fixed in versions 3.6.15 and 3.7.2.
Which versions are affected by CVE-2026-49453?
How do I fix CVE-2026-49453?
No fix has been published for CVE-2026-49453 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-49453 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-49453 exists.
Sources
Also known as GHSA-r24r-gp6h-cwgf.