CVE-2025-27409

Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, path traversal is possible in Joplin Server if static file path starts with css/pluginAssets or js/pluginAssets. The findLocalFile function i...

CVE-2025-27409

CVE-2025-27409 affects Joplin Server prior to version 3.3.3, where path traversal is possible when static files are requested under css/pluginAssets or js/pluginAssets. The default route’s findLocalFile calls localFileFromUrl and, if it returns a path, the result is sent without validating path t...