https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 16:03:39 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-319520 EUVD-2026-319520 https://cve.radiocsirt.org/vuln/euvd-2026-319520 https://cve.radiocsirt.org/vuln/fkie_cve-2026-22810 <p>Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions prior to 3.5.7 contain a path traversal vulnerability in the importer which allows overwriting arbitrary files on disk. The OneNote converter does not sanitize the names of embedded files before writing them to disk. As a result, it&#39;s possible for an attacker to create a malicious .one file that includes file names containing ../../, that are then interpreted as part of the target path when extracting attachments from the .one file. This issue has been patched in version 3.5.7.</p> <p>Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions prior to 3.5.7 contain a path traversal vulnerability in the importer which allows overwriting arbitrary files on disk. The OneNote converter does not sanitize the names of embedded files before writing them to disk. As a result, it&#39;s possible for an attacker to create a malicious .one file that includes file names containing ../../, that are then interpreted as part of the target path when extracting attachments from the .one file. This issue has been patched in version 3.5.7.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-22810 https://cve.radiocsirt.org/vuln/ghsa-gcmj-c9gg-9vh6 <p><strong>Affected:</strong> npm: @joplin/onenote-converter</p> <p>### Summary A path traversal vulnerability in the OneNote importer allows overwriting arbitrary files on disk.</p> <p>### Details The OneNote converter does not sanitize the names of embedded files before writing them to disk. As a result, it&#39;s possible for an attacker to create a malicious `.one` file that includes file names containing `../../`, that are then interpreted as part of the target path when extracting attachments from the `.one` file.</p> <p>One affected location is `embedded_file.rs`, which generates a file name from a string previously parsed from the `.one` file, https://github.com/laurent22/joplin/blob/af5108d70233b1db9410346958c1587cf7c1b16d/packages/onenote-converter/renderer/src/page/embedded_file.rs#L13-L16</p> <p>Above, [`determine_filename`](https://github.com/laurent22/joplin/blob/af5108d70233b1db9410346958c1587cf7c1b16d/packages/onenote-converter/renderer/src/page/embedded_file.rs#L56-L64) passes through the provided file name.</p> <p>[Similar logic](https://github.com/laurent22/joplin/blob/4d7fa5972fe2986eae14cbf3a2801835cbe1384e/packages/onenote-converter/src/page/embedded_file.rs#L14) has been present since 4d7fa5972fe2986eae14cbf3a2801835cbe1384e (Joplin 3.2.2), when the OneNote importer was first introduced.</p> <p>### PoC</p> <p>[Screencast from 2025-11-20 13-50-21.webm](https://github.com/user-attachments/assets/a9d6cc64-ec11-4f33-9f92-32efe0eaab23)</p> <p>1. Import [poc_v2.zip](https://github.com/user-attachments/files/23664109/poc_v2.zip). 2. Open the application&#39;s profile directo…</p> <p><strong>Affected:</strong> npm: @joplin/onenote-converter</p> <p>### Summary A path traversal vulnerability in the OneNote importer allows overwriting arbitrary files on disk.</p> <p>### Details The OneNote converter does not sanitize the names of embedded files before writing them to disk. As a result, it&#39;s possible for an attacker to create a malicious `.one` file that includes file names containing `../../`, that are then interpreted as part of the target path when extracting attachments from the `.one` file.</p> <p>One affected location is `embedded_file.rs`, which generates a file name from a string previously parsed from the `.one` file, https://github.com/laurent22/joplin/blob/af5108d70233b1db9410346958c1587cf7c1b16d/packages/onenote-converter/renderer/src/page/embedded_file.rs#L13-L16</p> <p>Above, [`determine_filename`](https://github.com/laurent22/joplin/blob/af5108d70233b1db9410346958c1587cf7c1b16d/packages/onenote-converter/renderer/src/page/embedded_file.rs#L56-L64) passes through the provided file name.</p> <p>[Similar logic](https://github.com/laurent22/joplin/blob/4d7fa5972fe2986eae14cbf3a2801835cbe1384e/packages/onenote-converter/src/page/embedded_file.rs#L14) has been present since 4d7fa5972fe2986eae14cbf3a2801835cbe1384e (Joplin 3.2.2), when the OneNote importer was first introduced.</p> <p>### PoC</p> <p>[Screencast from 2025-11-20 13-50-21.webm](https://github.com/user-attachments/assets/a9d6cc64-ec11-4f33-9f92-32efe0eaab23)</p> <p>1. Import [poc_v2.zip](https://github.com/user-attachments/files/23664109/poc_v2.zip). 2. Open the application&#39;s profile directo…</p> https://cve.radiocsirt.org/vuln/ghsa-gcmj-c9gg-9vh6 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1569 <p>Ein Angreifer kann mehrere Schwachstellen in Joplin ausnutzen, um einen Denial of Service Angriff durchzuführen, vertrauliche Informationen offenzulegen oder beliebige Dateien zu überschreiben, was möglicherweise zur Ausführung von beliebigem Code führt.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Joplin ausnutzen, um einen Denial of Service Angriff durchzuführen, vertrauliche Informationen offenzulegen oder beliebige Dateien zu überschreiben, was möglicherweise zur Ausführung von beliebigem Code führt.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1569