CVE-2025-27409

Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, path traversal is possible in Joplin Server if static file path starts with `css/pluginAssets` or `js/pluginAssets`. The `findLocalFile` function in the `default route` calls `localFileFromUrl` to check for special `pluginAssets` paths. If the function returns a path, the result is returned directly, without checking for path traversal. The vulnerability allows attackers to read files outside the intended directories. This issue has been patched in version 3.3.3.

• CWE-22

• https://github.com/laurent22/joplin/pull/11916Patch
• https://github.com/laurent22/joplin/security/advisories/GHSA-5xv6-7jm3-fmg5Exploit, Vendor Advisory
• https://github.com/laurent22/joplin/security/advisories/GHSA-5xv6-7jm3-fmg5Exploit, Vendor Advisory

Published

Apr 30, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-27403Ratify is a verification engine as a binary executable and o…7.2
• CVE-2025-27404Icinga Web 2 is an open source monitoring web interface, fra…6.1
• CVE-2025-27405Icinga Web 2 is an open source monitoring web interface, fra…6.1
• CVE-2025-27406Icinga Reporting is the central component for reporting rela…7.6
• CVE-2025-27407graphql-ruby is a Ruby implementation of GraphQL. Starting i…9
• CVE-2025-27408Manifest offers users a one-file micro back end. Prior to ve…4.8
• CVE-2025-27410PwnDoc is a penetration test reporting application. Prior to…6.5
• CVE-2025-27411REDAXO is a PHP-based CMS. In Redaxo before 5.18.3, the medi…5.4
• CVE-2025-27412REDAXO is a PHP-based CMS. In Redaxo from 5.0.0 through 5.18…6.1
• CVE-2025-27413PwnDoc is a penetration test reporting application. Prior to…4.9
• CVE-2025-27414MinIO is a high performance object storage. Starting in RELE…4.6
• CVE-2025-27415Nuxt is an open-source web development framework for Vue.js.…7.5