Executive brief
jotty.page is a self-hosted application used for managing personal checklists and notes. A security flaw allows unauthorized individuals to access sensitive files on the server without logging in. This could lead to the exposure of user records, password hashes, and active session tokens, potentially allowing attackers to take over accounts or access private data.
Technical details
An unauthenticated path traversal vulnerability exists in the jotty.page API endpoint /api/app-icons/[filename]. The root cause is located in app/api/app-icons/[filename]/route.ts, where the 'filename' route parameter is joined to a filesystem path using path.join() without subsequent canonicalization or boundary validation. By providing encoded traversal sequences (e.g., ..%2F), a remote attacker can escape the intended 'app-icons' directory to read arbitrary files on the host system. This can result in the disclosure of sensitive application data, including user password hashes and session-token mappings. The issue is resolved in version 1.22.0.
Affected products
- fccview jotty.page < 1.22.0
Timeline
- 2026-04-25: advisory: GitHub Security Advisory published by maintainer
- 2026-05-11: disclosed: CVE published to NVD
- 2026-05-11: patched: Fix confirmed in version 1.22.0