Is CVE-2026-22810 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-22810 being exploited in the wild.

How severe is CVE-2026-22810?

High severity, with a CVSS score of 8.2, published 18 May 2026.

Which products and versions are affected?

Joplin < 3.5.7, <= 3.5.6; Laurent Cozic Joplin Desktop 3.2.2 - 3.5.6; Laurent Cozic Onenote-Converter <= 3.5.1; Markus Siemens One2html <= 1.3.0; and 1 more.

Is there a fix for CVE-2026-22810?

Yes. @joplin/onenote-converter (npm): upgrade to 3.5.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-22810 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-22810?

Check whether you run Joplin, Laurent Cozic Joplin Desktop, Laurent Cozic Onenote-Converter or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-22810: Joplin path traversal in OneNote importer

Q: Which products and versions are affected?

Joplin < 3.5.7, <= 3.5.6; Laurent Cozic Joplin Desktop 3.2.2 - 3.5.6; Laurent Cozic Onenote-Converter <= 3.5.1; Markus Siemens One2html <= 1.3.0; and 1 more.

Q: Is there a fix for CVE-2026-22810?

Yes. @joplin/onenote-converter (npm): upgrade to 3.5.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-22810 attacked?

It is attacked with local access, in a network appliance.

Q: Am I affected by CVE-2026-22810?

Check whether you run Joplin, Laurent Cozic Joplin Desktop, Laurent Cozic Onenote-Converter or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-22810 · Severity: high · CVSS 8.2 · Published 2026-05-18

Joplin, an open-source note-taking and to-do application, is vulnerable to a security flaw in its OneNote import tool. An attacker can create a specially crafted OneNote (.one) file that, when imported by a user, overwrites important files on the user's computer. This could lead to the corruption of system files, loss of data, or unauthorized access to the user's device.

Technologies: Joplin. Vendors: Joplin, npm.

Quick answers

Is CVE-2026-22810 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-22810 being exploited in the wild.
How severe is CVE-2026-22810?: High severity, with a CVSS score of 8.2, published 18 May 2026.
Which products and versions are affected?: Joplin < 3.5.7, <= 3.5.6; Laurent Cozic Joplin Desktop 3.2.2 - 3.5.6; Laurent Cozic Onenote-Converter <= 3.5.1; Markus Siemens One2html <= 1.3.0; and 1 more.
Is there a fix for CVE-2026-22810?: Yes. @joplin/onenote-converter (npm): upgrade to 3.5.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-22810 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-22810?: Check whether you run Joplin, Laurent Cozic Joplin Desktop, Laurent Cozic Onenote-Converter or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@joplin/onenote-converter (npm): upgrade to 3.5.7 or later
```
npm install @joplin/onenote-converter@3.5.7
```

Technical details

A path traversal vulnerability exists in the OneNote converter component of Joplin. The root cause is a failure to sanitize the names of embedded files within a .one archive before writing them to disk. An attacker can craft a malicious OneNote file containing filenames with path traversal sequences (e.g., '../../'). When a user imports this file, the application interprets these sequences as part of the target path, allowing the attacker to write or overwrite arbitrary files outside of the intended import directory. This vulnerability is triggered during the extraction of attachments and has been addressed in version 3.5.7 by implementing proper filename sanitization.

Affected products

Joplin Joplin < 3.5.7

Identifiers

CVE-2026-22810
GHSA-gcmj-c9gg-9vh6

Timeline

2025-11-21: patched: Fix committed to repository
2026-05-18: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.