https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T14:42:31.759158+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-319520 EUVD-2026-319520 2026-10-03T14:42:31.824717+00:00 EUVD-2026-319520 https://cve.radiocsirt.org/vuln/fkie_cve-2026-22810 fkie_cve-2026-22810 2026-10-03T14:42:31.824756+00:00

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions prior to 3.5.7 contain a path traversal vulnerability in the importer which allows overwriting arbitrary files on disk. The OneNote converter does not sanitize the names of embedded files before writing them to disk. As a result, it's possible for an attacker to create a malicious .one file that includes file names containing ../../, that are then interpreted as part of the target path when extracting attachments from the .one file. This issue has been patched in version 3.5.7.

 https://cve.radiocsirt.org/vuln/ghsa-gcmj-c9gg-9vh6 GHSA-gcmj-c9gg-9vh6 — @joplin/onenote-converter: Path traversal in OneNote importer allows overwriting arbitrary files 2026-10-03T14:42:31.824794+00:00

Affected: npm: @joplin/onenote-converter

### Summary A path traversal vulnerability in the OneNote importer allows overwriting arbitrary files on disk.

### Details The OneNote converter does not sanitize the names of embedded files before writing them to disk. As a result, it's possible for an attacker to create a malicious `.one` file that includes file names containing `../../`, that are then interpreted as part of the target path when extracting attachments from the `.one` file.

One affected location is `embedded_file.rs`, which generates a file name from a string previously parsed from the `.one` file, https://github.com/laurent22/joplin/blob/af5108d70233b1db9410346958c1587cf7c1b16d/packages/onenote-converter/renderer/src/page/embedded_file.rs#L13-L16

Above, [`determine_filename`](https://github.com/laurent22/joplin/blob/af5108d70233b1db9410346958c1587cf7c1b16d/packages/onenote-converter/renderer/src/page/embedded_file.rs#L56-L64) passes through the provided file name.

[Similar logic](https://github.com/laurent22/joplin/blob/4d7fa5972fe2986eae14cbf3a2801835cbe1384e/packages/onenote-converter/src/page/embedded_file.rs#L14) has been present since 4d7fa5972fe2986eae14cbf3a2801835cbe1384e (Joplin 3.2.2), when the OneNote importer was first introduced.

### PoC

[Screencast from 2025-11-20 13-50-21.webm](https://github.com/user-attachments/assets/a9d6cc64-ec11-4f33-9f92-32efe0eaab23)

1. Import [poc_v2.zip](https://github.com/user-attachments/files/23664109/poc_v2.zip). 2. Open the application's profile directo…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1569 WID-SEC-W-2026-1569 — Joplin: Mehrere Schwachstellen 2026-10-03T14:42:31.824843+00:00

Ein Angreifer kann mehrere Schwachstellen in Joplin ausnutzen, um einen Denial of Service Angriff durchzuführen, vertrauliche Informationen offenzulegen oder beliebige Dateien zu überschreiben, was möglicherweise zur Ausführung von beliebigem Code führt.