CVE-2025-27409

Summary

CVE-2025-27409 is a path traversal vulnerability affecting versions of Joplin, a free and open-source note-taking and to-do application, prior to 3.3.3. The issue lies in the Joplin Server where static file paths starting with `css/pluginAssets` or `js/pluginAssets` are susceptible to path traversal attacks. The `findLocalFile` function in the default route of the application calls `localFileFromUrl` to retrieve files with special `pluginAssets` paths. Without proper validation, this function allows attackers to read files outside the intended directories. This vulnerability has been addressed in Joplin version 3.3.3 with proper path validation implemented.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.