CVE-2026-49453

Executive Summary

CVE-2026-49453 is a path-traversal and path-injection vulnerability in Joplin, the open source note-taking and to-do application, affecting versions prior to 3.6.15 and 3.7.2. Joplin accepts synchronized resource metadata whose id or file_extension fields contain parent-directory (..) or path-separator characters, and during background synchronization the application writes the attacker-controlled resource blob outside the intended resource directory. An attacker with write access to a configured sync target or a shared notebook can create or overwrite files at an attacker-chosen existing path without any user interaction, giving a high-integrity-impact primitive that can be chained into code execution or configuration tampering depending on the target path.

Technical Analysis

The vulnerability class is improper input neutralization (CWE-20) applied to filesystem path construction, publicly rated CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L (base score 7.0). The NVD description identifies three specific components in the data flow:

1. BaseItem.unserialize() — the deserialization routine that parses synchronized resource metadata. It stores the attacker-supplied id or file_extension values without validation. These fields originate from the sync target and are therefore attacker-controllable when the attacker has write access to that target.
2. resourceFilename() — a path-construction helper that concatenates the unvalidated metadata fields into a destination path. Because id and file_extension are interpolated directly, embedded .. sequences or path-separator characters (/, \) redirect the resolved destination outside the resource directory.
3. ResourceFetcher — the component that performs the actual write of the resource blob during background synchronization. It writes the attacker-controlled blob to the path produced by resourceFilename().

The trust boundary violated here is the synchronization channel. Joplin's design assumes the sync target (WebDAV, S3, Joplin Server, filesystem, or a shared notebook) contains only well-formed, Joplin-generated resource metadata. This CVE demonstrates that a malicious or compromised sync source is treated as authoritative for both content and destination path, so a low-privilege writer on the sync target effectively gains a file-write primitive inside the victim's filesystem.

The absence of CVE-supplied detail on exact encodings accepted (percent-encoding, Unicode normalization, Windows vs. POSIX separators) means operators should assume both separator conventions and mixed-normalization variants may be viable, and should treat the affected field set (id, file_extension) as fully untrusted.

Two additional constraints shape exploitation: AC:H (High attack complexity) reflects the requirement for a positioned write capability on a shared sync target, and UI:N confirms no victim interaction is needed — the write occurs through the normal background sync daemon cycle. The integrity subscore I:H reflects arbitrary create/overwrite of files at attacker-chosen existing paths; confidentiality C:L and availability A:L reflect incidental read exposure and possible local denial of service if critical files are overwritten.

Exploitation Scenarios

No public proof of concept, Nuclei template, or exploit code is available for CVE-2026-49453; the attack chain below is inferred from the vulnerability class (path traversal via unvalidated metadata) and the components named in the NVD description only.

1. Reconnaissance / target identification. The attacker identifies Joplin users or a Joplin deployment whose synchronization target is writable by the attacker — for example a shared WebDAV/S3 bucket, a self-hosted Joplin Server instance reachable by the attacker, or a shared notebook to which the attacker has been granted write access. Target identification centers on where Joplin clients pull resource metadata and blobs from, not on the endpoint device itself.

2. Encapsulation of the malicious metadata. The attacker authors or mutates a resource entry in the sync target so that its metadata carries a malicious id or file_extension value containing parent-directory (..) or path-separator characters. Because BaseItem.unserialize() performs no validation on these fields, the malformed entry remains part of the legitimate synchronization set.

3. Trigger via background sync. On the victim client's next synchronization cycle, BaseItem.unserialize() stores the poisoned fields, resourceFilename() concatenates them into a destination path that resolves outside the resource directory, and ResourceFetcher writes the attacker-supplied blob to that location. No user interaction and no crafted link are required — the flaw triggers through normal synchronization.

4. Post-exploitation impact. The primitive is create/overwrite of a file at an attacker-chosen existing path, constrained by the victim user's filesystem privileges. Depending on the path chosen, impact ranges from data destruction or tampering (overwriting notes, config files, or plugin directories) to persistent code execution if a path is overwritten that is subsequently loaded or executed by the client or its plugins. Because the write is silent and delivered through the sync pipeline, detection typically depends on host-side file-integrity monitoring rather than user reports.

Impact Assessment

The blast radius is any Joplin client synchronizing against a target to which an adversary holds write access. CVSS 3.1 base score is 7.0 (High):

• Attack Vector (AV:N, Network). Exploitation is delivered over the network through the sync service, not local access.
• Attack Complexity (AC:H, High). The attacker must already possess write access to a configured sync target or shared notebook and must position a malicious resource entry; this is a meaningful precondition that limits indiscriminate mass exploitation.
• Privileges Required (PR:N). No privileges are required on the victim endpoint.
• User Interaction (UI:N). No user action is required; background synchronization is sufficient.
• Scope (S:U, Unchanged). Impact remains within the vulnerable client's security authority.
• Confidentiality (C:L, Low). Incidental exposure is possible, but the core primitive is write-oriented.
• Integrity (I:H, High). Arbitrary overwrite of files at attacker-chosen paths makes this the dominant impact.
• Availability (A:L, Low). Overwriting operational or configuration files can degrade, but not necessarily destroy, client availability.

Business impact concentrates on managed endpoints where Joplin is deployed in a shared-sync configuration (team notebooks, enterprise WebDAV/S3 backends, self-hosted Joplin Server) and where a lower-trust user or integration can write to the sync store. In such settings a single malicious or compromised writer can manipulate every synchronizing client — a horizontal impact across the user base. Because the write is unauthenticated at the endpoint and invisible in the UI, containment requires revoking sync access and performing forensic integrity validation of client file systems.

Detection Guidance

Note: Joplin sync traffic is frequently encrypted end-to-end, which limits network visibility into the malicious fields. Detection should therefore pair host-side file-integrity signals with sync-layer anomaly signals where available. The rules below target the generic technique signatures (path traversal in metadata, anomalous resource writes) rather than CVE-unique strings, since no PoC or attack artifact has been published.

Sigma Rule

title: Joplin Synchronization Path Traversal — Anomalous Resource Write (CVE-2026-49453)
id: 8f3c1d2a-5b6e-4c7d-9a01-3e2f4b5c6d7e
status: experimental
description: Detects file writes by the Joplin client process to locations outside its configured resource directory, consistent with CVE-2026-49453 path traversal via malicious synchronized resource metadata.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-49453
author: valtersit.com Threat Intelligence
date: 2026/05/01
tags:
  - attack.t1083
  - attack.t1195
logsource:
  category: file_event
detection:
  selection_process:
    Image|endswith:
      - '\Joplin.exe'
      - '\joplin-desktop'
      - '/joplin-desktop'
      - '/Joplin'
  selection_path_traversal:
    TargetFilename|contains:
      - '..\'
      - '../'
      - '..%2f'
      - '..%5c'
  selection_outside_resource_dir:
    TargetFilename|contains:
      - '\notes\'
      - '\resources\'
      - '/resources/'
      - '\.config\joplin-desktop\'
  condition: selection_process and (selection_path_traversal or selection_outside_resource_dir)
falsepositives:
  - Legitimate writes to Joplin profile directories not covered by the resource-dir filter
  - Backup or export operations initiated by the user
level: high

YARA Rule

rule CVE_2026_49453_Joplin_PathTraversal_Metadata
{
    meta:
        description = "Detects Joplin sync resource metadata containing path traversal or path separators in id/file_extension fields (CVE-2026-49453)"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-49453"
        date = "2026-05-01"
        severity = "high"

    strings:
        $m1 = "file_extension" ascii nocase
        $m2 = "resource_filename" ascii nocase
        $m3 = "baseitem" ascii nocase
        $dotdot_unix = "../" ascii
        $dotdot_win  = "..\\" ascii
        $enc_unix1   = "..%2f" ascii nocase
        $enc_win1    = "..%5c" ascii nocase
        $sep_mixed   = "resources/../" ascii nocase

    condition:
        uint32(0) != 0x04034b50 and
        filesize < 10MB and
        (
            ($m1 or $m2 or $m3) and
            any of ($dotdot_*)
        )
        or
        any of ($enc_unix1, $enc_win1, $sep_mixed)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-49453 Joplin Sync Resource Metadata Path Traversal Attempt"; flow:established,to_client; http.header_names; content:"Joplin"; nocase; http.response_body; content:"file_extension"; nocase; content:".."; distance:0; within:64; classtype:attempted-user; reference:cve,2026-49453; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-49453; metadata:affected_product Joplin, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2026_05_01; sid:2026494530; rev:1;)

alert http any any -> any any (msg:"CVE-2026-49453 Joplin Resource Metadata Encoded Traversal Payload"; flow:established,to_client; http.response_body; content:"file_extension"; nocase; pcre:"/(\.\.(%2f|%5c|\/|\\\\))/Ri"; classtype:attempted-user; reference:cve,2026-49453; sid:2026494531; rev:1;)

Elastic Detection

file where process.name in ("Joplin.exe", "joplin-desktop", "Joplin") and
  (
    wildcard(file.path, "*../*") or
    wildcard(file.path, "*..\\*") or
    wildcard(file.path, "*..%2f*") or
    wildcard(file.path, "*..%5c*")
  )

Companion EQL for the client process write event:

process where process.name in ("Joplin.exe", "joplin-desktop", "Joplin") and event.action == "file_write" and
  not wildcard(file.path, "*" + "resources" + "*")

Splunk SPL Query

index=endpoint (source="WinEventLog:Sysmon" EventCode=11 OR source="linux:audit" type=SYSCALL)
(process_name IN ("Joplin.exe","joplin-desktop","Joplin") OR Image IN ("*\\Joplin.exe","*/joplin-desktop","*/Joplin"))
(TargetFilename="*../*" OR TargetFilename="*..\\*" OR TargetFilename="*..%2f*" OR TargetFilename="*..%5c*")
| eval risk=case(match(TargetFilename,"\.(sh|bash|zsh|ps1|bat|cmd|dll|so|dylib|js)$"),"critical", true(),"high")
| stats count min(_time) as first_seen max(_time) as last_seen values(TargetFilename) as paths by host, process_name, risk
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| sort - risk, last_seen

Wazuh OSSEC Rule

<group name="joplin,cve-2026-49453,sysmon">
  <rule id="100453" level="12">
    <if_sid>61612</if_sid>
    <field name="win.eventdata.image">(?i)(Joplin\.exe|joplin-desktop|Joplin)$</field>
    <field name="win.eventdata.targetFilename">(?i)(\.\.(\\|/|%2f|%5c))</field>
    <description>CVE-2026-49453: Joplin client wrote to path with traversal sequence - possible malicious sync resource metadata</description>
    <mitre>
      <id>T1083</id>
      <id>T1195</id>
    </mitre>
    <group>file_event,critical,</group>
  </rule>

  <rule id="100454" level="10">
    <if_sid>61612</if_sid>
    <field name="win.eventdata.image">(?i)(Joplin\.exe|joplin-desktop|Joplin)$</field>
    <field name="win.eventdata.targetFilename">(?i)(\\Config\\.*\.(js|json|dll)|/\.config/joplin-desktop/.*)</field>
    <description>CVE-2026-49453: Joplin client write to configuration/plugin path outside resource directory</description>
    <group>file_event,high,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor advisory, commit hash, or workaround was provided in the tracked data. The version information below is derived solely from the NVD description.

1. Immediate mitigations (pre-patch containment):

   • Treat the synchronization target as a trust boundary. Audit who has write access to every configured sync target (WebDAV, S3, Joplin Server, filesystem sync, shared notebooks) and revoke write access from any principal who does not require it.
   • Where the sync backend supports it, enable write logging and integrity monitoring on resource metadata; alert on any resource entry containing .. sequences or path separators in id or file_extension fields.
   • Deploy the host-based file-write detections above (Sigma/YARA/Sysmon/auditd) on all endpoints running Joplin, prioritizing the Joplin profile, resource, and plugin directories.
   • Maintain offline, versioned backups of Joplin profile directories so an overwritten file can be restored without trusting the sync store.
   • Isolate Joplin clients from high-value paths by running the client under a restricted account with least privilege over the filesystem.

2. Patch / upgrade steps:

   • Upgrade to Joplin 3.6.15 or 3.7.2 or later as soon as builds are available and validated. These are the versions named as fixed in the NVD description.
   • Because no vendor advisory or checksum was provided in the tracked sources, verify the authenticity of release artifacts through Joplin's official release channels and signature/hash data before deployment.
   • After upgrading, force a full resynchronization from a sync target that has been validated as free of malicious resource metadata; upgrading the client does not sanitize already-poisoned server-side entries.

3. Long-term hardening:

   • Keep client-side validation authoritative: reject any synchronized metadata whose id or file_extension contains path separators, parent-directory sequences, or non-expected characters, and canonicalize paths before writing.
   • Restrict writes from the resource synchronization pipeline to a single dedicated resource directory using OS-level controls (permissions, mount options, sandboxing) so a future bypass cannot escape the boundary.
   • Apply defense in depth: content-addressed resource IDs, integrity verification of synchronized blobs, and privilege separation for the Joplin client process.
   • Subscribe to Joplin security advisories and re-scan the fleet when a patched release or vendor advisory is published; re-assess patch confidence at that time.

References

• NVD — CVE-2026-49453: https://nvd.nist.gov/vuln/detail/CVE-2026-49453
• CWE-20: Improper Input Validation — https://cwe.mitre.org/data/definitions/20.html
• MITRE ATT&CK T1195 — Supply Chain Compromise: https://attack.mitre.org/techniques/T1195/
• MITRE ATT&CK T1083 — File and Directory Discovery: https://attack.mitre.org/techniques/T1083/
• Joplin project release source (verify 3.6.15 / 3.7.2 artifacts and checksums via official channels): https://github.com/laurent22/joplin

Threat actor and in-the-wild evidence: none available. CVE-2026-49453 is not listed in CISA KEV, no public proof of concept, exploit code, or Nuclei template has been observed, and no campaign attribution exists in the tracked data. EPSS has not yet scored this CVE (per the provided data); no EPSS value should be assumed. The exploit primitive is technically straightforward once sync write access is obtained, so organizations with shared or semi-trusted sync backends should prioritize the containment measures above regardless of current exploitation status.