CVE-2026-42564

Description

jotty·page is a self-hosted app for your checklists and notes. Prior to 1.22.0, an unauthenticated path traversal vulnerability exists in /api/app-icons/[filename]. The filename route parameter is joined into a filesystem path without traversal/boundary validation, allowing file reads outside data/uploads/app-icons/. This vulnerability is fixed in 1.22.0.

PUBLISHED Reserved 2026-04-28 | Published 2026-05-11 | Updated 2026-05-12 | Assigner GitHub_M

Problem types

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Product status

References

github.com/.../jotty/security/advisories/GHSA-7843-gwq8-g96f

cve.org (CVE-2026-42564)

nvd.nist.gov (CVE-2026-42564)

Download JSON