CVE-2026-59816

Received Received - Intake

Path Traversal in Joplin Server

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, the GET /api/transcribe/:id and POST /api/transcribe/:id handlers in packages/server/src/routes/api/transcribe.ts on Joplin Server instances with TRANSCRIBE_ENABLED=true pass the decoded id directly into transcription backend URLs. An authenticated user can place URL-encoded slash and parent-directory segments in the job ID, causing parseSubPath() to decode a path that escapes the intended /transcribe/ prefix. The server then proxies the request to other transcription-backend endpoints and can return their responses, potentially exposing internal administrative, health, or configuration data. This issue is fixed in version 3.7.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-09-21

Generated

2026-09-22

AI Q&A

2026-09-22

EPSS Evaluated

N/A

NVD

CVE-2026-59816

Affected Vendors & Products

Vendor	Product	Version / Range
joplin	joplin	3.7.7

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

Joplin Server before 3.7.7 has a path traversal flaw in the transcription API handlers. Authenticated users can exploit URL-encoded slashes and parent directory segments in job IDs to bypass intended path restrictions. This allows them to access unintended endpoints on the transcription backend, potentially leaking sensitive data like admin or health information.

Detection Guidance

Check Joplin Server version with 'curl -s http://localhost:22300/api/version | grep version' or similar. If version is below 3.7.7, the system is vulnerable. Inspect network traffic for unusual requests to /api/transcribe/ endpoints with URL-encoded path traversal sequences like %2f or %2e%2e.

Impact Analysis

If you run a Joplin Server instance with transcription enabled, an attacker with valid credentials could access internal administrative, health, or configuration data from the transcription backend. This could lead to unauthorized information disclosure or further attacks on your system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) or HIPAA (health information privacy) requirements. Organizations must ensure proper access controls and data protection measures to maintain compliance.

Mitigation Strategies

Upgrade Joplin Server to version 3.7.7 or later immediately. If upgrading is not possible, disable the TRANSCRIBE_ENABLED feature in configuration or restrict access to the /api/transcribe/ endpoints via network policies until patched.

Hi! I’m here to help you understand CVE-2026-59816. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70