CVE-2026-42564
Path Traversal in Jotty Page Application
Publication date: 2026-05-11
Last updated on: 2026-05-11
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| jotty | page | 1.22.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in jotty·page, a self-hosted app for checklists and notes, in versions prior to 1.22.0. It is an unauthenticated path traversal vulnerability in the /api/app-icons/[filename] endpoint. The filename parameter is used directly to form a filesystem path without proper validation to prevent traversal outside the intended directory. This allows an attacker to read files outside the data/uploads/app-icons/ directory.
How can this vulnerability impact me? :
This vulnerability can allow an unauthenticated attacker to read arbitrary files on the server outside the intended directory. This could lead to exposure of sensitive information, such as configuration files, credentials, or other private data stored on the server. The CVSS score of 8.2 indicates a high severity impact with high confidentiality impact and low integrity impact.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade jotty·page to version 1.22.0 or later, where the unauthenticated path traversal issue in /api/app-icons/[filename] has been fixed.