CVE-2026-49449 laurent22 CVE debrief

Who should care

Defenders responsible for Windows deployments of Joplin, especially those who create or view notes with unfiltered links, should assess exposure and prioritize verification and updates.

Why it matters

This vulnerability allows an attacker to disclose the current user's NTLMv2 challenge-response on Windows, posing a risk to credential security. Defenders should prioritize verifying and updating Joplin, assessing exposure, and implementing compensating controls.

• Credential disclosure through NTLMv2 challenge-response
• Potential for SMB authentication initiation
• Verification priority for Joplin version 3.7.2 or later
• Assessing exposure for users with unfiltered links in notes

Technical summary

The vulnerability in Joplin arises from the application's handling of KaTeX links in note content, allowing an attacker to disclose the current user's NTLMv2 challenge-response on Windows. This issue is fixed in version 3.7.2. The application's failure to properly filter URLs in KaTeX links enables an attacker to craft a malicious link in a note, which when clicked, initiates SMB authentication and discloses the current user's NTLMv2 challenge-response. The vulnerability is demonstrated to occur when a user clicks a link with an attacker-controlled UNC path. Defenders should prioritize verifying and updating Joplin to version 3.7.2 or later, especially for Windows deployments, and assess exposure for users who

Defensive priority

Defenders should prioritize verifying and updating Joplin to version 3.7.2 or later, especially for Windows deployments, and assess exposure for users who create or view notes with unfiltered links.

Recommended defensive actions

• Verify and update Joplin to version 3.7.2 or later
• Assess exposure for users who create or view notes with unfiltered links
• Implement compensating controls for SMB authentication and NTLMv2 challenge-response
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The vulnerability allows an attacker to initiate SMB authentication and disclose the current user's NTLMv2 challenge-response on Windows by crafting a malicious link in a note. This issue is demonstrated to occur when a user clicks a link with an attacker-controlled UNC path.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.