# CVE-2026-49453: Joplin path traversal in resource synchronization

Source: https://junglewise.ai/threats/cve-2026-49453-joplin-is-an-open-source-note-taking-and-to-do-application-that  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-21. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-49453 · Severity: high · CVSS 7 · Published 2026-09-21

Joplin is an open-source note-taking application that syncs data across devices. Versions before 3.6.15 and 3.7.2 allow attackers with write access to a sync target or shared notebook to create or overwrite arbitrary files on a user's system during background synchronization, without any user interaction needed.

Technologies: [Joplin](https://junglewise.ai/threats/technologies/joplin). Vendors: [Joplin](https://junglewise.ai/threats/vendors/joplin).

## Quick answers

**Is CVE-2026-49453 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49453 being exploited in the wild.

**How severe is CVE-2026-49453?** High severity, with a CVSS score of 7, published 21 September 2026.

**Which products and versions are affected?** Joplin before 3.6.15 and before 3.7.2.

**Is there a fix for CVE-2026-49453?** A patch was published on 2026-06-20: Fix merged to reject malformed item IDs and improve resource filename determination Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49453 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-49453?** Check whether you run Joplin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a path traversal flaw in resource metadata handling. BaseItem.unserialize() fails to validate the id or file_extension fields before passing them to resourceFilename(), which concatenates them into a destination path. ResourceFetcher then writes attacker-controlled resource blobs outside the intended resource directory during sync. An attacker needs write access to the sync target or notebook.

## Affected products

- Joplin Joplin before 3.6.15 and before 3.7.2

## Timeline

- 2026-09-21: disclosed
- 2026-06-20: patched: Fix merged to reject malformed item IDs and improve resource filename determination

## References

- [https://github.com/laurent22/joplin/commit/18e0b08c282c89ae51612c4eff67af2a45ff5163](https://github.com/laurent22/joplin/commit/18e0b08c282c89ae51612c4eff67af2a45ff5163)
- [https://github.com/laurent22/joplin/commit/50518073740c4501058e366300b42c2f1925cb05](https://github.com/laurent22/joplin/commit/50518073740c4501058e366300b42c2f1925cb05)

## Related threats

- [Joplin CSS injection in whiteboard text and file nodes](https://junglewise.ai/threats/cve-2026-105784-joplin-is-an-open-source-note-taking-and-to-do-application-that)
- [Joplin XSS vulnerability in HTML note links](https://junglewise.ai/threats/cve-2026-46650-joplin-is-an-open-source-note-taking-and-to-do-application-that)
- [Joplin cross-site scripting in Fountain code blocks](https://junglewise.ai/threats/cve-2026-55105-joplin-is-an-open-source-note-taking-and-to-do-application-that)
- [Joplin denial of service via uncontrolled resource allocation in note titles](https://junglewise.ai/threats/cve-2025-57798-joplin-denial-of-service-via-uncontrolled-resource-allocation-in)
- [Joplin path traversal in OneNote importer](https://junglewise.ai/threats/cve-2026-22810-joplin-path-traversal-in-onenote-importer)