Executive brief
Joplin, an open-source note-taking and to-do application, is vulnerable to a security flaw in its OneNote import tool. An attacker can create a specially crafted OneNote (.one) file that, when imported by a user, overwrites important files on the user's computer. This could lead to the corruption of system files, loss of data, or unauthorized access to the user's device.
Technical details
A path traversal vulnerability exists in the OneNote converter component of Joplin. The root cause is a failure to sanitize the names of embedded files within a .one archive before writing them to disk. An attacker can craft a malicious OneNote file containing filenames with path traversal sequences (e.g., '../../'). When a user imports this file, the application interprets these sequences as part of the target path, allowing the attacker to write or overwrite arbitrary files outside of the intended import directory. This vulnerability is triggered during the extraction of attachments and has been addressed in version 3.5.7 by implementing proper filename sanitization.
Affected products
- Joplin Joplin < 3.5.7
Timeline
- 2025-11-21: patched: Fix committed to repository
- 2026-05-18: advisory: NVD publication date
References
- https://github.com/laurent22/joplin/blob/af5108d70233b1db9410346958c1587cf7c1b16d/packages/onenote-converter/renderer/src/page/embedded_file.rs
- https://github.com/laurent22/joplin/commit/791668455e1aae50501ff57ea4783b3fba9d377c
- https://github.com/laurent22/joplin/pull/13736
- https://github.com/laurent22/joplin/releases/tag/v3.5.7
- https://github.com/laurent22/joplin/security/advisories/GHSA-gcmj-c9gg-9vh6