A critical path traversal vulnerability in the Joplin OneNote converter allows attackers to access or manipulate files outside the intended directory.

The application is affected by a path traversal flaw (CWE-24) within the OneNote converter component. The vulnerability requires a local user and user interaction (UI:R) to trigger the traversal, which could lead to unauthorized file operations.

With a CVSS score of 8.2, this vulnerability represents a high risk to data integrity and confidentiality. An attacker could potentially read or overwrite sensitive notes and configuration files, leading to unauthorized information disclosure or potential remote code execution depending on the file types accessed.

Immediate Action: Update the Joplin application and the @joplin/onenote-converter package to version 3.5.7 or later.

Proactive Monitoring: Review application logs for unexpected file access patterns or suspicious import activity within the OneNote conversion module.

Compensating Controls: Restrict the application's file system permissions to only those directories strictly necessary for its operation to limit the scope of a potential traversal.

Public Exploit Available: No (exploit_available: unknown)

Due to the existence of a proof-of-concept and the potential for significant data compromise, upgrading to version 3.5.7 is mandatory. Users should verify their installation version immediately and ensure that all dependent packages are updated to their patched releases.