CVE-2026-49453: path traversal in sync

CISO Take

Joplin, a popular open source note-taking app, trusts resource IDs and file extensions arriving through synchronization, which lets an attacker with write access to a sync target or shared notebook write files outside the resource directory with no user interaction. The EPSS score of 0.0041 (top 67% by percentile), absence of a public exploit or Nuclei template, no CISA KEV listing and a TRACK* SSVC decision all point to low near-term exploitation likelihood, and the high attack complexity plus the need for sync-target write access limit the blast radius. The practical risk is that a shared notebook or compromised cloud sync backend becomes a route to overwrite files on every endpoint that syncs, which matters most for security teams and researchers who keep sensitive notes and AI research material in Joplin. Upgrade to Joplin 3.6.15 or 3.7.2 and review who has write access to shared notebooks and sync targets such as WebDAV, S3 or Nextcloud. Note that this is a general-purpose note-taking tool with only a tenuous AI/ML connection, so treat it as a standard endpoint patching item rather than a breaking AI threat.

Sources:NVDEPSSGitHub AdvisoryATLAS

What is the risk?

Medium-to-high severity (CVSS 7.0) but low likelihood of exploitation. Network-reachable via the sync channel, no privileges on the victim and no user interaction required, but high attack complexity and the prerequisite of write access to a configured sync target or shared notebook. Impact is mainly integrity (arbitrary file create/overwrite at an existing path), with limited confidentiality and availability effects. No public exploit, no scanner template, not in KEV, EPSS 0.0041. The AI/ML exposure is indirect: it only matters where Joplin holds AI project notes, prompts, credentials or is used alongside AI workstations.

How does the attack unfold?

Initial Access

Attacker gains write access to a configured sync target or is a collaborator on a shared notebook.

AML.T0049

Exploitation

Attacker publishes a resource whose id or file_extension contains path-traversal characters, which BaseItem.unserialize() stores without validation.

Arbitrary File Write

During background sync, ResourceFetcher writes the attacker-controlled blob to a path outside the resource directory.

Impact

Overwritten startup scripts or configuration files give the attacker persistence or code execution on the victim endpoint.

AML.T0112

Initial Access

Attacker gains write access to a configured sync target or is a collaborator on a shared notebook.

AML.T0049

Exploitation

Attacker publishes a resource whose id or file_extension contains path-traversal characters, which BaseItem.unserialize() stores without validation.

Arbitrary File Write

During background sync, ResourceFetcher writes the attacker-controlled blob to a path outside the resource directory.

Impact

Overwritten startup scripts or configuration files give the attacker persistence or code execution on the victim endpoint.

AML.T0112

How severe is it?

CVSS 3.1

7.0 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 35% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACHigh

PRNone

UINone

SUnchanged

CLow

IHigh

ALow

What should I do?

1 step

1) Upgrade Joplin to 3.6.15 or 3.7.2 or later on all desktop and mobile clients. 2) Until patched, pause synchronization or stop accepting shared notebooks from untrusted parties. 3) Restrict and audit write access to sync targets (WebDAV, S3, Nextcloud, Dropbox, OneDrive, Joplin Server) and rotate sync credentials if compromise is suspected. 4) Inspect the sync target for resource metadata whose id or file_extension contains '..', '/' or '\\'. 5) Monitor endpoints for unexpected file writes by the Joplin process outside its profile and resource directories, and for modified shell profiles, autostart entries or tool configuration files. 6) Run Joplin with least privilege and consider sandboxing or containerization on sensitive developer workstations.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply ChainCode ExecutionPluginAML.T0049- Exploit Public-Facing Application AML.T0112- Machine Compromise

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks and incidents

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-49453?

Joplin, a popular open source note-taking app, trusts resource IDs and file extensions arriving through synchronization, which lets an attacker with write access to a sync target or shared notebook write files outside the resource directory with no user interaction. The EPSS score of 0.0041 (top 67% by percentile), absence of a public exploit or Nuclei template, no CISA KEV listing and a TRACK* SSVC decision all point to low near-term exploitation likelihood, and the high attack complexity plus the need for sync-target write access limit the blast radius. The practical risk is that a shared notebook or compromised cloud sync backend becomes a route to overwrite files on every endpoint that syncs, which matters most for security teams and researchers who keep sensitive notes and AI research material in Joplin. Upgrade to Joplin 3.6.15 or 3.7.2 and review who has write access to shared notebooks and sync targets such as WebDAV, S3 or Nextcloud. Note that this is a general-purpose note-taking tool with only a tenuous AI/ML connection, so treat it as a standard endpoint patching item rather than a breaking AI threat.

Is CVE-2026-49453 actively exploited?

No confirmed active exploitation of CVE-2026-49453 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-49453?

1) Upgrade Joplin to 3.6.15 or 3.7.2 or later on all desktop and mobile clients. 2) Until patched, pause synchronization or stop accepting shared notebooks from untrusted parties. 3) Restrict and audit write access to sync targets (WebDAV, S3, Nextcloud, Dropbox, OneDrive, Joplin Server) and rotate sync credentials if compromise is suspected. 4) Inspect the sync target for resource metadata whose id or file_extension contains '..', '/' or '\\'. 5) Monitor endpoints for unexpected file writes by the Joplin process outside its profile and resource directories, and for modified shell profiles, autostart entries or tool configuration files. 6) Run Joplin with least privilege and consider sandboxing or containerization on sensitive developer workstations.

What systems are affected by CVE-2026-49453?

This vulnerability affects the following AI/ML architecture patterns: Developer and data-science workstations, Note-taking and knowledge-management tools, Cloud-synchronized collaboration tools.

What is the CVSS score for CVE-2026-49453?

CVE-2026-49453 has a CVSS v3.1 base score of 7.0 (HIGH). The EPSS exploitation probability is 0.41%.

What is the AI security impact?

Affected AI Architectures

Developer and data-science workstationsNote-taking and knowledge-management toolsCloud-synchronized collaboration tools

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0112Machine Compromise

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, Joplin accepts synchronized resource metadata whose id or file_extension contains parent-directory or path-separator characters. BaseItem.unserialize() stores the unvalidated fields, resourceFilename() concatenates them into a destination path, and ResourceFetcher writes the attacker-controlled resource blob outside the resource directory during background synchronization. An attacker with write access to a configured sync target or shared notebook can create or overwrite files at an attacker-chosen existing path without user interaction. This issue is fixed in versions 3.6.15 and 3.7.2.

Exploitation Scenario

An attacker who has compromised a shared sync backend, or who is an invited collaborator on a shared notebook, uploads a resource item whose file_extension is a path-traversal string such as '/../../../.zshrc' or whose id points to a startup script location, with a malicious payload as the blob. When a victim's Joplin client next performs background synchronization, ResourceFetcher writes the payload to the attacker-chosen existing path. If the target is a shell profile, scheduled script or agent configuration on a developer or ML engineer workstation, the attacker gains code execution on the next login or tool launch and can reach API keys, notebooks and model artifacts stored on that machine.

Weaknesses (CWE)

CWE-20Improper Input ValidationPrimary CWE-22Improper Limitation of a Pathname to a Restricted DirectoryPrimary CWE-20Improper Input Validation CWE-22Improper Limitation of a Pathname to a Restricted Directory

CWE-20 — Improper Input Validation: The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

[Architecture and Design] Consider using language-theoretic security (LangSec) techniques that characterize inputs using a formal language and build "recognizers" for that language. This effectively requires parsing to be a distinct layer that effectively enforces a boundary between raw input and internal data representations, instead of allowing parser code to be scattered throughout the program, where it could be subject to errors or inconsistencies that create weaknesses. [REF-1109] [REF-1110] [REF-1111]
[Architecture and Design] Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).

Source: MITRE CWE corpus.