CVE-2026-49453Proof of concept (PoC) published · CISA
Joplin: Path traversal in resource sync — silent arbitrary file write outside the resource directory
CVSS score
7.0
EPSS probability
%0.4
Risk score
0.0
Published
24 d ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
No verified public exploit code was found.
GitHub repositories, NVD exploit references and the Metasploit Framework were scanned. A record of active exploitation does not mean that public exploit code has been published.
Similar Vulnerabilities
9.1
CVE-2026-46649
Joplin: SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable via Unprotected Endpoint
L
Patch status unknownEPSS %1
7.7
CVE-2026-55105
Joplin: Fountain embeds allow arbitrary script execution in published notes and the note viewer
L
Patch status unknownEPSS %0
7.4
CVE-2026-55210
Joplin: SAML SSO account takeover via email-based account linking (missing is_external check in ssoLogin)
L
Patch status unknownEPSS %0
7.6
CVE-2026-59814
Joplin: Stored XSS via inline-served note attachment on published shares
L
Patch status unknownEPSS %0
8.5
CVE-2026-105786
Joplin: Unauthenticated account takeover via an attacker-chosen application-authorisation identifier
L
Patch status unknownEPSS %0
6.5
CVE-2026-55179
Joplin: Logic error in Joplin Server allows a signed-in user to read any note from its internal server ID
L
Patch status unknownEPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-49453"