Joplin’s resource sync component can process unvalidated metadata that contains directory separators or parent-directory references. When deserializing a synced resource, the application concatenates the “id” or “file_extension” values into a file path, and the write operation does not prevent out-of-directory placement. An attacker who can write to a sync target or shared notebook may therefore create or overwrite files at any existing path on the host system. This silent overwrite capability can be leveraged to modify configuration files, install malicious payloads, or otherwise compromise the integrity of the system, potentially leading to remote code execution if the attacker can place executable files in a location that is later executed.

The issue affects all instances of Joplin running versions earlier than 3.6.15 and earlier than 3.7.2. Specifically, any Joplin 3.6.x release before 3.6.15 or any 3.7.x release before 3.7.2 is vulnerable. The vulnerability is present in the standard desktop application as well as in any installation that synchronizes resources to a shared target or notebook; the vendor laurent22 is the maintainer of the application.

The vulnerability carries a CVSS score of 7, indicating medium to high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that an adversary already have write access to the configured sync target or shared notebook. While no widespread exploitation has been reported, the potential to overwrite arbitrary files in a trusted environment makes this a significant risk to confidentiality, integrity, and availability of affected systems.