What’s Vulnerable › Vulnerabilities

CVE-2025-27409: Joplin Server Vulnerable to Path Traversal

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-04-30 · updated 2026-06-17
• Weakness: CWE-22

Description

Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, path traversal is possible in Joplin Server if static file path starts with `css/pluginAssets` or `js/pluginAssets`. The `findLocalFile` function in the `default route` calls `localFileFromUrl` to check for special `pluginAssets` paths. If the function returns a path, the result is returned directly, without checking for path traversal. The vulnerability allows attackers to read files outside the intended directories. This issue has been patched in version 3.3.3.

Affected products

• laurent22 joplin: before 3.3.3 — fixed in 3.3.3

How to fix

Upgrade to a fixed version: laurent22 joplin 3.3.3. Check the vendor advisory for mitigations.

References

• https://github.com/laurent22/joplin/pull/11916
• https://github.com/laurent22/joplin/security/advisories/GHSA-5xv6-7jm3-fmg5
• https://github.com/laurent22/joplin/security/advisories/GHSA-5xv6-7jm3-fmg5

Get alerted when CVE-2025-27409 or the next vulnerability affects your stack