The Joplin application contains a path traversal vulnerability in its OneNote importer. When an attacker supplies a malicious .one file with embedded file names that include sequences like '../../', the importer interprets these as part of the target path and writes the extracted attachments directly to those locations. This flaw allows the attacker to overwrite any file that the Joplin process can write to, potentially compromising application data or altering system configuration.

Both Windows, macOS, and Linux installations of Joplin built by laurent22 that are older than version 3.5.7 are susceptible. The vulnerability specifically resides in the OneNote import module that handles .one file attachments.

The vulnerability is assigned a CVSS score of 8.2, reflecting a high severity. No EPSS score has been published, so exploitation likelihood remains uncertain. The flaw is not listed in the CISA KEV catalog. An attacker who can deliver a crafted .one file to a user will be able to write arbitrary files to disk, but the description does not indicate that this alone results in remote code execution; the risk primarily lies in unauthorized file modification or potential compromise of sensitive data.