CVE-2026-22810Disclosure(joplinapp / joplin)

LOWCVSS 7.3 · HIGH

Signal is active with 4 mentions in latest observed window

Immediate actions

Patch joplinapp joplin systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions prior to 3.5.7 contain a path traversal vulnerability in the importer which allows overwriting arbitrary files on disk. The OneNote converter does not sanitize the names of embedded files before writing them to disk. As a result, it's possible for an attacker to create a malicious .one file that includes file names containing ../../, that are then interpreted as part of the target path when extracting attachments from the .one file. This issue has been patched in version 3.5.7.

joplinapp CVEs Back to dashboard

1.0/ 10 priority

Sources & remediation

Patch / fix

Vendor / third-party advisories

Other references

Weakness type (CWE)

CWE-24

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

joplin
one2html

Threat summary

Patch or workaround signal is available
4 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 4 signals
Disclosure: 3 classified signals
4 total mentions across 1 day

Affected systems

Vendors

joplinapp msiemens

Products

joplinone2html

Deep dive

Activity timeline4 mentions / 1d

Signal classification2 categories

Disclosure

375.0%

Patch

125.0%

Referenced assets4 URLs

By indicator

Full discourse4 posts

ADK Cyber@ADKCyber143d
Patch
CVE-2026-22810 (CVSS 8.2): Joplin note-taking app versions before 3.5.7 contain a path traversal issue in the importer. Organizations using Joplin should update promptly. https://nvd.nist.gov/vuln/detail/CVE-2026-22810 via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning
Post summary
Joplin note‑taking app versions before 3.5.7 contain a path traversal vulnerability (CVSS 8.2); users are urged to update to a patched version to mitigate the risk.
0001072
80 followersView on X
Infoflowcloud@infoflowcloud144d
Disclosure
🚨*CVE* CVE-2026-22810 Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions prior to 3.5.7 contain a path traversal vulnerabili… https://www.cve.org/CVERecord?id=CVE-2026-22810 ----- Traducción: CVE-2026-22810 Jop… http://infoflow.cloud`
Post summary
CVE-2026-22810 is a path traversal vulnerability in Joplin affecting all versions prior to 3.5.7, with the issue fixed in newer releases.
0000041
78 followersView on X
CVE@CVEnew144d
Disclosure
CVE-2026-22810 Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions prior to 3.5.7 contain a path traversal vulnerabili… https://www.cve.org/CVERecord?id=CVE-2026-22810
Post summary
The text announces a path traversal vulnerability in Joplin before version 3.5.7, providing exposure details but no PoC, exploit, or patch information.
00000206
57.5K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds144d
Disclosure
CVE-2026-22810 Path Traversal Vulnerability in Joplin Versions Prior to 3.5.7 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-22810
Post summary
The excerpt announces CVE-2026-22810 as a path‑traversal flaw affecting Joplin versions prior to 3.5.7, linking to a vulnerability details page but providing no proof‑of‑concept, exploit code, or patch information.
0000059
4.0K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	joplinapp	joplin	-	-	-
App	msiemens	one2html	-	rust	-

Explore more

Back to dashboard joplinapp CVEs msiemens CVEs joplin vulnerabilities

What researchers are saying

CVE-2026-22810

ADK Cyber[verified]@ADKCyberPatch

Joplin note‑taking app versions before 3.5.7 contain a path traversal vulnerability (CVSS 8.2); users are urged to update to a patched version to mitigate the risk.

Infoflowcloud@infoflowcloudDisclosure

CVE-2026-22810 is a path traversal vulnerability in Joplin affecting all versions prior to 3.5.7, with the issue fixed in newer releases.

CVE@CVEnewDisclosure

The text announces a path traversal vulnerability in Joplin before version 3.5.7, providing exposure details but no PoC, exploit, or patch information.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The excerpt announces CVE-2026-22810 as a path‑traversal flaw affecting Joplin versions prior to 3.5.7, linking to a vulnerability details page but providing no proof‑of‑concept, exploit code, or patch information.