# CVE-2026-22810: Joplin path traversal in OneNote importer

Source: https://junglewise.ai/threats/cve-2026-22810-joplin-path-traversal-in-onenote-importer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-18. Updated: 2026-05-18  
License: CC BY 4.0 with a link back

CVE-2026-22810 · Severity: high · CVSS 8.2 · Published 2026-05-18

Joplin, an open-source note-taking and to-do application, is vulnerable to a security flaw in its OneNote import tool. An attacker can create a specially crafted OneNote (.one) file that, when imported by a user, overwrites important files on the user's computer. This could lead to the corruption of system files, loss of data, or unauthorized access to the user's device.

Technologies: [Joplin](https://junglewise.ai/threats/technologies/joplin). Vendors: [Joplin](https://junglewise.ai/threats/vendors/joplin), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-22810 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-22810 being exploited in the wild.

**How severe is CVE-2026-22810?** High severity, with a CVSS score of 8.2, published 18 May 2026.

**Which products and versions are affected?** Joplin < 3.5.7, <= 3.5.6; Laurent Cozic Joplin Desktop 3.2.2 - 3.5.6; Laurent Cozic Onenote-Converter <= 3.5.1; Markus Siemens One2html <= 1.3.0; and 1 more.

**Is there a fix for CVE-2026-22810?** Yes. @joplin/onenote-converter (npm): upgrade to 3.5.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-22810 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-22810?** Check whether you run Joplin, Laurent Cozic Joplin Desktop, Laurent Cozic Onenote-Converter or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @joplin/onenote-converter (npm): upgrade to 3.5.7 or later

  ```sh
  npm install @joplin/onenote-converter@3.5.7
  ```


## Technical details

A path traversal vulnerability exists in the OneNote converter component of Joplin. The root cause is a failure to sanitize the names of embedded files within a .one archive before writing them to disk. An attacker can craft a malicious OneNote file containing filenames with path traversal sequences (e.g., '../../'). When a user imports this file, the application interprets these sequences as part of the target path, allowing the attacker to write or overwrite arbitrary files outside of the intended import directory. This vulnerability is triggered during the extraction of attachments and has been addressed in version 3.5.7 by implementing proper filename sanitization.

## Affected products

- Joplin Joplin < 3.5.7

## Identifiers

- CVE-2026-22810
- GHSA-gcmj-c9gg-9vh6

## Timeline

- 2025-11-21: patched: Fix committed to repository
- 2026-05-18: advisory: NVD publication date

## References

- [https://github.com/laurent22/joplin/blob/af5108d70233b1db9410346958c1587cf7c1b16d/packages/onenote-converter/renderer/src/page/embedded_file.rs](https://github.com/laurent22/joplin/blob/af5108d70233b1db9410346958c1587cf7c1b16d/packages/onenote-converter/renderer/src/page/embedded_file.rs)
- [https://github.com/laurent22/joplin/commit/791668455e1aae50501ff57ea4783b3fba9d377c](https://github.com/laurent22/joplin/commit/791668455e1aae50501ff57ea4783b3fba9d377c)
- [https://github.com/laurent22/joplin/pull/13736](https://github.com/laurent22/joplin/pull/13736)
- [https://github.com/laurent22/joplin/releases/tag/v3.5.7](https://github.com/laurent22/joplin/releases/tag/v3.5.7)
- [https://github.com/laurent22/joplin/security/advisories/GHSA-gcmj-c9gg-9vh6](https://github.com/laurent22/joplin/security/advisories/GHSA-gcmj-c9gg-9vh6)

## Related threats

- [Joplin CSS injection in whiteboard text and file nodes](https://junglewise.ai/threats/cve-2026-105784-joplin-is-an-open-source-note-taking-and-to-do-application-that)
- [Joplin XSS vulnerability in HTML note links](https://junglewise.ai/threats/cve-2026-46650-joplin-is-an-open-source-note-taking-and-to-do-application-that)
- [Joplin cross-site scripting in Fountain code blocks](https://junglewise.ai/threats/cve-2026-55105-joplin-is-an-open-source-note-taking-and-to-do-application-that)
- [Joplin path traversal in resource synchronization](https://junglewise.ai/threats/cve-2026-49453-joplin-is-an-open-source-note-taking-and-to-do-application-that)
- [Joplin denial of service via uncontrolled resource allocation in note titles](https://junglewise.ai/threats/cve-2025-57798-joplin-denial-of-service-via-uncontrolled-resource-allocation-in)