Path Traversal in Joplin Project
CVE-2025-27409
Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, path traversal is possible in Joplin Server if static file path starts with `css/pluginAssets` or `js/pluginAssets`. The `findLocalFile` function in the `default route` calls `localFileFromUrl` to check for special `pluginAssets` paths. If the function returns a path, the result is returned directly, without checking for path traversal. The vulnerability allows attackers to read files outside the intended directories. This issue has been patched in version 3.3.3.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.006 (48.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Joplin_project Joplin
- Laurent22 Joplin — versions < 3.3.3
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-27409?
- CVE-2025-27409 is a high-severity vulnerability in Joplin Project, classified under Path Traversal. CVSS score: 7.5/10. Published 2025-04-30.
- How severe is CVE-2025-27409?
- High severity. CVSS v3 base score is 7.5 out of 10.