Threats affecting pkg:github/fccview/jotty

CVE-2026-42564 is a high-severity path traversal vulnerability in jotty, a self-hosted checklist and notes app by fccview. Versions prior to 1.22.0 allow unauthenticated attackers to read arbitrary files outside the intended directory via the /api/app-icons/[filename] endpoint. This occurs because the filename parameter is concatenated into a filesystem path without proper validation to prevent traversal. The vulnerability is fixed in version 1.22.0. No known exploits are reported in the wild.