CVE-2026-22810 laurent22 CVE debrief

Who should care

Joplin users who import OneNote files; security teams managing note-taking application deployments; organizations using Joplin for sensitive documentation workflows

Technical summary

The Joplin OneNote converter (embedded_file.rs) writes embedded file attachments from .one files to disk without sanitizing filename paths. Malicious OneNote files containing path traversal sequences (e.g., ../../etc/critical-file) in embedded attachment names cause files to be written outside the intended extraction directory, enabling arbitrary file overwrite with attacker-controlled content. This affects confidentiality, integrity, and availability of the host system.

Defensive priority

HIGH

Recommended defensive actions

• Upgrade Joplin to version 3.5.7 or later to remediate this vulnerability
• Block or quarantine .one file imports from untrusted sources until patching is complete
• Audit systems for unexpected file modifications in directories writable by Joplin processes
• Review file integrity of critical system files if malicious .one imports are suspected
• Consider disabling OneNote import functionality if not required for business operations

Evidence notes

Vulnerability exists in packages/onenote-converter/renderer/src/page/embedded_file.rs lines 13-16. Fix commit 791668455e1aae50501ff57ea4783b3fba9d377c merged via PR #13736.

Official resources