« Volver al listado

CVE-2026-22810

Estado: AnalizadaAlta (7.3)—

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions prior to 3.5.7 contain a path traversal vulnerability in the importer which allows overwriting arbitrary files on disk. The OneNote converter does not sanitize the names of embedded files before writing them to disk. As a result, it's possible for an attacker to create a malicious .one file that includes file names containing ../../, that are then interpreted as part of the target path when extracting attachments from the .one file. This issue has been patched in version 3.5.7.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Requiere interacción del usuario (UI:R) para abrir archivo .one malicioso. El path traversal permite sobrescribir archivos arbitrarios en disco (T1565.001) y potencialmente ejecutar código si se sobreescriben binarios o scripts (T1059).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Restrict Web-Based ContentRestrict File and Directory PermissionsPrivileged Account ManagementRemote Data StorageLimit Software InstallationExecution Prevention

Tecnologías afectadas (2)

Joplinapp — JoplinMsiemens — One2html

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-22810",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-22810",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-19T00:00:00+00:00"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.2,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 1.5
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.3,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.3
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "laurent22",
          "product": "joplin",
          "versions": [
            {
              "status": "affected",
              "version": "< 3.5.7"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-05-18T21:16:39.373",
  "references": [
    {
      "url": "https://github.com/laurent22/joplin/blob/af5108d70233b1db9410346958c1587cf7c1b16d/packages/onenote-converter/renderer/src/page/embedded_file.rs#L13-L16",
      "tags": [
        "Product"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/laurent22/joplin/commit/791668455e1aae50501ff57ea4783b3fba9d377c",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/laurent22/joplin/pull/13736",
      "tags": [
        "Issue Tracking"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/laurent22/joplin/releases/tag/v3.5.7",
      "tags": [
        "Patch",
        "Product"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/laurent22/joplin/security/advisories/GHSA-gcmj-c9gg-9vh6",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/laurent22/joplin/security/advisories/GHSA-gcmj-c9gg-9vh6",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-24"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions prior to 3.5.7 contain a path traversal vulnerability in the importer which allows overwriting arbitrary files on disk. The OneNote converter does not sanitize the names of embedded files before writing them to disk. As a result, it's possible for an attacker to create a malicious .one file that includes file names containing ../../, that are then interpreted as part of the target path when extracting attachments from the .one file. This issue has been patched in version 3.5.7."
    },
    {
      "lang": "es",
      "value": "Joplin es una aplicación de código abierto para tomar notas y gestionar tareas que organiza notas y listas en cuadernos. Las versiones anteriores a la 3.5.7 contienen una vulnerabilidad de salto de ruta en el importador que permite sobrescribir archivos arbitrarios en el disco. El conversor de OneNote no sanea los nombres de los archivos incrustados antes de escribirlos en el disco. Como resultado, es posible que un atacante cree un archivo .one malicioso que incluya nombres de archivo que contengan .. / ../, los cuales son luego interpretados como parte de la ruta de destino al extraer archivos adjuntos del archivo .one. Este problema ha sido parcheado en la versión 3.5.7."
    }
  ],
  "lastModified": "2026-07-24T13:10:00.223",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:joplinapp:joplin:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "864FE8BA-88B5-4C60-BEAA-DA2B104AA7B6",
              "versionEndExcluding": "3.5.7"
            },
            {
              "criteria": "cpe:2.3:a:msiemens:one2html:*:*:*:*:*:rust:*:*",
              "vulnerable": true,
              "matchCriteriaId": "388B685F-E69E-455C-A6DF-C44652AC77C2",
              "versionEndIncluding": "1.3.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}