A path-traversal vulnerability in Joplin’s OneNote importer could let a malicious .one file overwrite files on disk when its embedded attachments were extracted. Tracked as CVE-2026-22810, the issue affects Joplin versions before 3.5.7 and was fixed in that release, according to the Joplin security advisory. [1]
The flaw is in the importer rather than Microsoft OneNote itself. The converter failed to sanitize attachment names before writing them to disk, allowing crafted names containing ../../ sequences to escape the intended extraction directory. An attacker would need to persuade a local user to import the booby-trapped notebook, after which the importer could overwrite files accessible to the Joplin process.
The National Vulnerability Database rates the vulnerability 7.3 High under CVSS 3.1, using a vector requiring local access, low privileges and user interaction. NVD also records an 8.2 High score supplied by GitHub, whose vector treats the impact as crossing a security boundary. The database lists CWE-24, path traversal, and identifies Joplin versions below 3.5.7 as affected. NVD’s entry does not report a CVSS 4.0 score or confirmed exploitation in the wild. [1]
For defenders, the finding matters wherever analysts, migration teams or users process untrusted OneNote exports through Joplin. A successful overwrite could damage application data or replace files that later become executable, although exploitation still depends on getting the victim to import the crafted notebook. Security teams should treat externally supplied .one files as untrusted input and avoid extracting them on systems containing sensitive or operationally important files.
Joplin users should upgrade the desktop application to 3.5.7 or later before importing OneNote notebooks. Microsoft separately warns that embedded files in OneNote can be used to deliver harmful content and has documented protections that block dangerous file extensions, but those controls do not patch Joplin’s third-party importer. [1]
