CVE-2026-42564

jotty·page is a self-hosted app for your checklists and notes. Prior to 1.22.0, an unauthenticated path traversal vulnerability exists in /api/app-icons/[filename]. The filename route parameter is joined into a filesystem path without traversal/boundary validation, allowing file reads outside data/uploads/app-icons/. This vulnerability is fixed in 1.22.0.

• CWE-22
• CWE-200

• https://github.com/fccview/jotty/security/advisories/GHSA-7843-gwq8-g96f

Published

May 11, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42559RMCP is an official Rust SDK for the Model Context Protocol.…8.8
• CVE-2026-4256Improper neutralization of special elements used in an LDAP …8.2
• CVE-2026-42560auth provides authentication via oauth2, direct and email. F…9.1
• CVE-2026-42561Python-Multipart is a streaming multipart parser for Python.…7.5
• CVE-2026-42562Plainpad is a self hosted note taking app. Prior to version …8.3
• CVE-2026-42563Dulwich is a pure-Python implementation of the Git file form…7.7
• CVE-2026-42565@workos/authkit-session is a toolkit for building WorkOS Aut…4.3
• CVE-2026-42566Meshtastic is an open source mesh networking solution. Prior…7.5
• CVE-2026-42567Svelte is a performance oriented web framework. From version…7.5
• CVE-2026-42568Yamcs is a mission control framework. Prior to versions 5.13…4.3
• CVE-2026-42569phpVMS is a PHP application to run and simulate an airline. …9.4
• CVE-2026-4257The Contact Form by Supsystic plugin for WordPress is vulner…9.8