CVE-2025-27409: Joplin Server Vulnerable to Path Traversal
Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, path traversal is possible in Joplin Server if static file path starts with `css/pluginAssets` or `js/pluginAssets`. The `findLocalFile` function in the `default route` calls `localFileFromUrl` to check for special `pluginAssets` paths. If the function returns a path, the result is returned directly, without checking for path traversal. The vulnerability allows attackers to read files outside the intended directories. This issue has been patched in version 3.3.3.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27409?
CVE-2025-27409 has been classified as a medium severity vulnerability due to its potential for path traversal exploits.
How do I fix CVE-2025-27409?
To fix CVE-2025-27409, upgrade Joplin Server to version 3.3.3 or later.
What does CVE-2025-27409 affect?
CVE-2025-27409 affects Joplin Server versions prior to 3.3.3.
Can CVE-2025-27409 be exploited remotely?
Yes, CVE-2025-27409 can be exploited remotely if the server is misconfigured.
What are the potential impacts of CVE-2025-27409?
Exploiting CVE-2025-27409 may allow an attacker to access restricted paths on the server, potentially leading to unauthorized information exposure.