PatchTheCVE: joplin project

CVE-2025-27409: Joplin is a free, open source note taking and to-do application, which can handle a large number of notes orga

Wed, 17 Jun 2026 09:03:31 +0000

HIGH 7.5: Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, path traversal is possible in Joplin Server if static file path starts with `css/pluginAssets` or `js/pluginAssets`. The `findLocalFile` functio

CVE-2025-27134: Joplin is a free, open source note taking and to-do application, which can handle a large number of notes orga

Wed, 17 Jun 2026 09:03:04 +0000

HIGH 8.8: Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, a privilege escalation vulnerability exists in the Joplin server, allowing non-admin users to exploit the API endpoint `PATCH /api/users/:id` to

CVE-2025-25187: Joplin is a free, open source note taking and to-do application, which can handle a large number of notes orga

Wed, 17 Jun 2026 09:00:26 +0000

HIGH 7.8: Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. This vulnerability is caused by adding note titles to the document using React's `dangerouslySetInnerHTML`, without first escaping HTML entities. Joplin lacks a Content

CVE-2025-24028: Joplin is a free, open source note taking and to-do application, which can handle a large number of notes orga

Wed, 17 Jun 2026 08:57:55 +0000

HIGH 7.8: Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. This vulnerability is caused by differences between how Joplin's HTML sanitizer handles comments and how the browser handles comments. This affects both the Rich Text E

CVE-2024-55630: Joplin is a free, open source note taking and to-do application, which can handle a large number of notes orga

Wed, 17 Jun 2026 08:11:19 +0000

LOW 3.3: Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Joplin's HTML sanitizer allows the `name` attribute to be specified. If `name` is set to the same value as an existing `document` property (e.g. `querySelector`), that

CVE-2024-53268: Joplin is an open source, privacy-focused note taking app with sync capabilities for Windows, macOS, Linux, An

Wed, 17 Jun 2026 08:08:43 +0000

HIGH 7.2: Joplin is an open source, privacy-focused note taking app with sync capabilities for Windows, macOS, Linux, Android and iOS. In affected versions attackers are able to abuse the fact that openExternal is used without any filtering of URI schemes to obtain remote code execution in Windows environment