Path Traversal in Joplin Project
CVE-2025-27409
Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, path traversal is possible in Joplin Server if static file path starts with `css/pluginAssets` or `js/pluginAssets`. The `findLocalFile` function in the `default route` calls `localFileFromUrl` to check for special `pluginAssets` paths. If the function returns a path, the result is returned directly, without checking for path traversal. The vulnerability allows attackers to read files outside the intended directories. This issue has been patched in version 3.3.3.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.007 (51.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 52nd percentile — 51.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.007 · change: +0.000
Affected products
- Joplin Project
- Laurent22 Joplin — versions < 3.3.3
Weakness classification (CWE)
References
- github.com/laurent22/joplin/security/advisories/GHSA-5xv6-7jm3-fmg5 (Exploit, Vendor Advisory)
- github.com/laurent22/joplin/pull/11916 (Patch)
Frequently asked questions
- What is CVE-2025-27409?
- CVE-2025-27409 is a high-severity vulnerability in Joplin Project, classified under Path Traversal. CVSS score: 7.5/10. Published 2025-04-30.
- How severe is CVE-2025-27409?
- High severity. CVSS v3 base score is 7.5 out of 10.