CVE-2026-22810 is a path traversal vulnerability (CWE-24) in the laurent22 Joplin note-taking application, specifically in versions prior to 3.5.7. The vulnerability exists in the OneNote file importer component, which fails to sanitize embedded filenames containing directory traversal sequences ('../'). This allows an attacker to craft malicious .one files that, when imported, cause arbitrary files on the victim's disk to be overwritten. The vulnerability has a CVSS 3.1 base score of 8.2, indicating high severity with local attack vector, low complexity, requiring limited privileges and user interaction, and impacts confidentiality, integrity, and availability. The issue was fixed in Joplin version 3.5.7.

Successful exploitation allows an attacker with local access and limited privileges to overwrite arbitrary files on the victim's filesystem by importing a malicious .one file. This can lead to compromise of confidentiality, integrity, and availability of data on the affected system. The vulnerability requires user interaction (importing the crafted file) and local access but can cause significant damage by overwriting critical files.

A fix is available in Joplin version 3.5.7. Users and administrators should upgrade to version 3.5.7 or later to remediate this vulnerability. Since this is not a cloud service, patching the client application is required. There is no vendor advisory content explicitly stating otherwise. Until upgraded, avoid importing untrusted OneNote (.one) files to mitigate risk.