CVE-2026-49453

🗓️ 21 Sep 2026 20:50:28Reported by GitHub_MType

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, Joplin accepts synchronized resource metadata whose id or file_extension contains parent-directory or path-separat...

Reporter	Title	Published	Views	Family All 4
Circl	CVE-2026-49453	21 Sep 202621:37	–	circl
Cvelist	CVE-2026-49453 Joplin: Path traversal in resource sync — silent arbitrary file write outside the resource directory	21 Sep 202620:50	–	cvelist
EUVD	EUVD-2026-84167	21 Sep 202620:50	–	euvd
NVD	CVE-2026-49453	21 Sep 202621:17	–	nvd

Vulners

Node

joplin_project joplinRange<3.6.15

joplin_project joplinRange3.7.0–3.7.2

[
  {
    "vendor": "laurent22",
    "product": "joplin",
    "versions": [
      {
        "version": "< 3.6.15",
        "status": "affected"
      },
      {
        "version": ">= 3.7.0, < 3.7.2",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/laurent22/joplin/pull/15672
github	www.github.com/laurent22/joplin/commit/50518073740c4501058e366300b42c2f1925cb05
github	www.github.com/laurent22/joplin/commit/18e0b08c282c89ae51612c4eff67af2a45ff5163
github	www.github.com/laurent22/joplin/pull/15540
github	www.github.com/laurent22/joplin/security/advisories/GHSA-r24r-gp6h-cwgf

21 Sep 2026 21:17Current

CVSS 3.17