Description

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, the GET /api/transcribe/:id and POST /api/transcribe/:id handlers in packages/server/src/routes/api/transcribe.ts on Joplin Server instances with TRANSCRIBE_ENABLED=true pass the decoded id directly into transcription backend URLs. An authenticated user can place URL-encoded slash and parent-directory segments in the job ID, causing parseSubPath() to decode a path that escapes the intended /transcribe/ prefix. The server then proxies the request to other transcription-backend endpoints and can return their responses, potentially exposing internal administrative, health, or configuration data. This issue is fixed in version 3.7.7.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-21T21:17:06.490Z",
  "pubdate": "2026-09-21T21:17:06.490Z",
  "executiveSummary": "A path traversal vulnerability exists in Joplin Server versions prior to 3.7.7, specifically within the transcription API handlers when the TRANSCRIBE_ENABLED environment variable is set to true.\nThe vulnerability allows an authenticated attacker to manipulate the 'id' parameter in 'GET /api/transcribe/:id' and 'POST /api/transcribe/:id' requests to escape the intended directory structure.\nBy injecting URL-encoded path traversal sequences (e.g., ../), an attacker can bypass the intended '/transcribe/' prefix scope, allowing the server to proxy requests to unauthorized internal API endpoints.\nThe impact includes potential information disclosure of sensitive configuration, system health data, or administrative endpoints within the transcription backend infrastructure.\nSuccessful exploitation requires the attacker to have an authenticated account on the Joplin Server instance and relies on the server-side configuration where the transcription feature is enabled.",
  "technicalDetails": "The vulnerability resides in the request handling logic located in 'packages/server/src/routes/api/transcribe.ts'. The application fails to adequately sanitize the ':id' parameter before passing it to the internal backend proxying mechanism.\nSpecifically, the 'parseSubPath()' function is utilized to process the path segment extracted from the request. When an attacker provides a maliciously crafted 'id' containing URL-encoded directory traversal sequences such as '%2f' (slash) or '%2e%2e%2f' (parent-directory), the function decodes these sequences improperly.\nThis decoding process enables the resulting path to break out of the context of the '/transcribe/' directory, which is the expected scope for backend transcription requests. Because the server directly uses this unsanitized, decoded path to construct the request URI for the transcription backend, it facilitates an arbitrary request proxying scenario.\nThe attack flow is as follows: 1) An authenticated user initiates an HTTP request to 'GET /api/transcribe/[payload]' or 'POST /api/transcribe/[payload]'. 2) The payload is crafted to include path traversal sequences that represent the structure of the internal backend API. 3) The 'parseSubPath()' logic, operating in a vulnerable state, resolves this payload into a path outside the intended directory. 4) The server-side proxy sends the modified request to the transcription backend, interpreting the attacker-supplied path as a valid internal resource request. 5) The transcription backend returns the contents of the unintended endpoint back to the attacker.\nThe vulnerability is limited to instances where 'TRANSCRIBE_ENABLED=true' is configured. As the server acts as a proxy for these requests, it inadvertently allows an attacker to interact with any endpoint reachable through the backend service that would otherwise be protected or hidden from the public-facing API. This can lead to the exfiltration of system metadata, environmental configuration, or other sensitive administrative data, depending on the capabilities of the backend services exposed to the proxy.\nThis flaw underscores the risks associated with dynamic path construction using user-supplied input without rigorous validation or canonicalization to ensure the resulting path remains within a restricted directory tree."
}