Vulnerabilities

TI-2026-18327 CVE-2026-22810 · GHSA-gcmj-c9gg-9vh6

Joplin: Path traversal in OneNote importer allows overwriting arbitrary files

HIGH 71

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks.

CVSS 3.1HIGH 8.2 Local Low privileges User interaction EPSS 0.00206 Published 2026-05-18 Fixed in 3.5.7 CWE-24

TI-2022-19118 CVE-2022-40277 · GHSA-mjr5-v9c9-mm7g

Improper input validation in Joplin

LOW 37

Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00541 Published 2022-09-30 No fix listed CWE-20

TI-2022-15851 CVE-2022-35131 · GHSA-ww2v-frv5-pj5x

Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles.

MEDIUM 43

Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.02305 Published 2022-07-25 Fixed in 2.9.1 CWE-79

TI-2021-06123 CVE-2021-23431 · GHSA-gjwp-7v3g-99pj

Cross-site request forgery (CSRF) in joplin

LOW 38

The package joplin before 2.3.2 are vulnerable to Cross-site Request Forgery (CSRF) due to missing CSRF checks in various forms.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00403 Published 2021-08-24 Fixed in 2.3.2 CWE-352

Vulnerabilities

Filters

Joplin: Path traversal in OneNote importer allows overwriting arbitrary files

Improper input validation in Joplin

Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles.

Cross-site request forgery (CSRF) in joplin