Vulnerability · Published Apr 30, 2025 · Assigned by GitHub_M

CVE-2025-27409Joplin Server Vulnerable to Path Traversal

High 7.5

In plain English

A high-severity path traversal in joplin from laurent22. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.7%top 48.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, path traversal is possible in Joplin Server if static file path starts with `css/pluginAssets` or `js/pluginAssets`. The `findLocalFile` function in the `default route` calls `localFileFromUrl` to check for special `pluginAssets` paths. If the function returns a path, the result is returned directly, without checking for path traversal. The vulnerability allows attackers to read files outside the intended directories. This issue has been patched in version 3.3.3.

Affected products (as reported)

Vendor	Product	Versions
laurent22	joplin	< 3.3.3

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/laurent22/joplin/security/advisories/GHSA-5xv6-7jm3-fmg5 x_refsource_CONFIRM
https://github.com/laurent22/joplin/pull/11916 x_refsource_MISC