CVE-2026-59816 in Joplin
Summary
by MITRE • 09/22/2026
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, the GET /api/transcribe/:id and POST /api/transcribe/:id handlers in packages/server/src/routes/api/transcribe.ts on Joplin Server instances with TRANSCRIBE_ENABLED=true pass the decoded id directly into transcription backend URLs. An authenticated user can place URL-encoded slash and parent-directory segments in the job ID, causing parseSubPath() to decode a path that escapes the intended /transcribe/ prefix. The server then proxies the request to other transcription-backend endpoints and can return their responses, potentially exposing internal administrative, health, or configuration data. This issue is fixed in version 3.7.7.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in Joplin Server versions prior to 3.7.7 represents a critical path traversal flaw within the transcription API endpoints. Specifically, the GET and POST handlers for /api/transcribe/:id fail to adequately sanitize user-supplied input before constructing URLs for downstream services. When an instance is configured with TRANSCRIBE_ENABLED=true, these endpoints accept a job identifier from authenticated users and pass it directly into internal logic that builds proxy requests to transcription backend servers. The core technical failure lies in the insufficient validation of path segments within this identifier, allowing attackers to manipulate the resulting URL structure through encoded special characters such as forward slashes and parent-directory sequences like ..
This lack of strict input validation enables an authenticated attacker to perform a directory traversal attack against internal infrastructure components that are not intended for public access. By injecting URL-encoded slash and dot-dot-slash sequences into the job ID parameter, the application's parseSubPath function decodes these segments, effectively breaking out of the designated /transcribe/ prefix boundary. Consequently, the server proxies requests to arbitrary paths on the transcription backend rather than restricting them to the expected operational endpoints. This behavior transforms a standard API interaction into an unauthorized access vector for internal services that may lack their own authentication mechanisms or are protected only by network-level isolation assumptions which can be bypassed via this application-layer proxying mechanism.
The operational impact of this vulnerability is significant, as it allows authenticated users to exfiltrate sensitive information from the transcription backend infrastructure. Successful exploitation can lead to the exposure of internal administrative interfaces, health check endpoints that reveal system status and version details, or configuration files containing secrets and connection strings. This constitutes a severe breach of confidentiality for the organization running Joplin Server, as it compromises the integrity of the microservice architecture by allowing lateral movement from an authenticated user account into sensitive backend systems. The attack does not require privilege escalation beyond standard authentication, making it accessible to any valid user on the platform who can exploit this misconfiguration.
From a classification perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory and CWE-918: Server-Side Request Forgery (SSRF). The exploitation technique involves manipulating input to bypass intended access controls on internal resources, which is also characteristic of ATT&CK tactic T1071.004 Application Layer Protocol: Web Protocols for lateral movement or data exfiltration within a trusted network perimeter. Security teams should recognize this as an SSRF variant where the application acts as a proxy to reach otherwise inaccessible endpoints due to flawed path handling logic rather than direct IP-based access control failures.
To mitigate this risk, organizations must immediately upgrade Joplin Server to version 3.7.7 or later, which includes patches for these input validation flaws. In addition to upgrading, administrators should verify that the transcription backend services are not exposed directly to untrusted networks and implement strict allow-listing of permitted paths within any proxy configurations. It is also advisable to review authentication requirements on internal health and administrative endpoints to ensure they remain protected even if application-layer filters fail. Regular security audits focusing on API parameter handling and path traversal prevention mechanisms will help maintain the integrity of similar microservice architectures against evolving attack vectors.