| Package | Affected versions | Patched versions |
|---|---|---|
| joplin | < 3.5.7 | 3.5.7 |
| one2html | ≤ 1.3.0 | |
| @joplin/onenote-converter | < 3.5.7 | 3.5.7 |
A path traversal vulnerability in the OneNote importer allows overwriting arbitrary files on disk.
The OneNote converter does not sanitize the names of embedded files before writing them to disk. As a result, it's possible for an attacker to create a malicious .one file that includes file names containing ../../, that are then interpreted as part of the target path when extracting attachments from the .one file.
One affected location is embedded_file.rs, which generates a file name from a string previously parsed from the .one file,
https://github.com/laurent22/joplin/blob/af5108d70233b1db9410346958c1587cf7c1b16d/packages/onenote-converter/renderer/src/page/embedded_file.rs#L13-L16
Above, determine_filename passes through the provided file name.
Similar logic has been present since 4d7fa5972fe2986eae14cbf3a2801835cbe1384e (Joplin 3.2.2), when the OneNote importer was first introduced.
Screencast from 2025-11-20 13-50-21.webm
log.txt.log.txt has been overwritten non-log-file content (a WAV file).Tested on Fedora Linux 43 with Joplin 3.4.12 (prod, linux) and Joplin 3.5.6 (dev, linux).
Note: The PoC ZIP file overwrites Joplin's log.txt. It is also possible to craft a file that overwrites more sensitive system files (e.g. .bashrc on Linux).
This is a path traversal vulnerability that impacts all versions of Joplin (<= v3.5.6) that include a OneNote importer. Importing a crafted OneNote export file allows an attacker to overwrite arbitrary files, potentially leading to remote code execution.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free