CVE-2026-22810: Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions prior to 3.5.7 contain a path traversal…

PriorityP342high7.3CVSS 3.1

AVLACLPRLUIRSUCHIHAH

EPSS

0.21%

10.7th percentile

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions prior to 3.5.7 contain a path traversal vulnerability in the importer which allows overwriting arbitrary files on disk. The OneNote converter does not sanitize the names of embedded files before writing them to disk. As a result, it's possible for an attacker to create a malicious .one file that includes file names containing ../../, that are then interpreted as part of the target path when extracting attachments from the .one file. This issue has been patched in version 3.5.7.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
joplin	onenote-converter	>= 0 < 3.5.7	3.5.7
joplinapp	joplin	< 3.5.7	3.5.7
laurent22	joplin	< 3.5.7	3.5.7
msiemens	one2html	<= 1.3.0	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.