Description

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, Joplin accepts synchronized resource metadata whose id or file_extension contains parent-directory or path-separator characters. BaseItem.unserialize() stores the unvalidated fields, resourceFilename() concatenates them into a destination path, and ResourceFetcher writes the attacker-controlled resource blob outside the resource directory during background synchronization. An attacker with write access to a configured sync target or shared notebook can create or overwrite files at an attacker-chosen existing path without user interaction. This issue is fixed in versions 3.6.15 and 3.7.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.0",
  "pubDate": "2026-09-21T21:17:03.900Z",
  "pubdate": "2026-09-21T21:17:03.900Z",
  "executiveSummary": "Joplin versions prior to 3.6.15 and 3.7.2 are susceptible to an arbitrary file write vulnerability resulting from improper validation of synchronized resource metadata.\nThis vulnerability is classified as a path traversal flaw that allows an attacker with access to a synchronization target—such as a cloud storage provider or a shared notebook—to write or overwrite arbitrary files within the local file system of a client running the application.\nThe exploitation occurs without user interaction during the background synchronization process, as the application processes malicious metadata containing directory traversal sequences.\nThe impact includes potential remote code execution or system compromise if an attacker overwrites sensitive configuration files, binary executables, or startup scripts accessible to the user running Joplin.\nThe vulnerability originates from the lack of sanitization in the id and file_extension fields, which are subsequently concatenated into file paths used for local resource storage.\nTo mitigate this risk, users must upgrade to the patched versions immediately and audit their synchronized data sources for suspicious resource metadata.",
  "technicalDetails": "The vulnerability resides in the resource handling logic of the Joplin synchronization engine. The root cause is a failure to sanitize user-controlled metadata during the synchronization process. Specifically, the fields id and file_extension in the synchronized resource metadata are processed without verifying the presence of path-separator characters or parent-directory sequences (e.g., '../').\nThe technical flow begins when the client application fetches resource metadata from a synchronized target. The BaseItem.unserialize() function deserializes this data, storing the unvalidated fields directly into the application's internal state. Subsequently, the resourceFilename() function constructs the local file system path by concatenating these tainted fields into the destination directory structure.\nBecause the application does not normalize or sanitize these strings, an attacker can craft resource metadata where the id or file_extension contains directory traversal vectors. When the ResourceFetcher component initiates the write operation for the associated resource blob, the path concatenation results in an absolute or relative path that points outside the intended local resource directory.\nExploitation requires the attacker to have write access to the synchronized storage backend or a shared notebook. When the target Joplin instance performs a background synchronization, the ResourceFetcher inadvertently traverses the local file system and writes the attacker-controlled resource blob to the specified destination. By manipulating the path, an attacker can overwrite critical application files, user profile data, or execute arbitrary binary/script files if those files are automatically loaded by the operating system or the application itself.\nAffected versions include all releases prior to 3.6.15 and 3.7.2. The vulnerability does not require authentication from the victim's perspective, as the exploit is triggered autonomously during the background synchronization cycle. The lack of input validation at the deserialization layer ensures that the malicious payload is treated as a trusted path, allowing the process to inherit the permissions of the Joplin user to write files into any location the user has write access to."
}