The vulnerability allows an authenticated user to supply a transcribe job identifier containing URL-encoded slashes and parent‑directory tokens to the Joplin Server. The server decodes this identifier and uses it as part of a proxy URL when calling external transcription backends via the /api/transcribe/:id endpoints. Because the decoding step strips the intended /transcribe/ prefix, the attacker can redirect the proxy to internal administrative, health, or configuration endpoints, thereby exposing sensitive data. This path‑traversal flaw is classified as CWE‑22 and carries a CVSS score of 4.3.

The flaw afflicts the Joplin Server component provided by Laurent22. All instances running a version earlier than 3.7.7 and with the TRANSCRIBE_ENABLED feature turned on are affected.

The vulnerability is limited to authenticated users who can invoke the transcribe API with TRANSCRIBE_ENABLED set to true. The exploitation requires the attacker to control the job ID and attempt to redirect the proxy to internal resources. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Given the moderate CVSS rating and the authentication requirement, the risk is moderate but significant for environments that expose internal endpoints through the transcription service.