CVE-2026-42564

HIGH

jotty·page: Unauthenticated Path Traversal leads to sensitive file disclosure and session-token reuse impact

Title source: cna
STIX 2.1

Description

jotty·page is a self-hosted app for your checklists and notes. Prior to 1.22.0, an unauthenticated path traversal vulnerability exists in /api/app-icons/[filename]. The filename route parameter is joined into a filesystem path without traversal/boundary validation, allowing file reads outside data/uploads/app-icons/. This vulnerability is fixed in 1.22.0.

References (1)

Core 1
Core References

Scores

CVSS v3 8.2
EPSS 0.0032
EPSS Percentile 23.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-200 CWE-22
Status published
Products (1)
fccview/jotty < 1.22.0
Published May 11, 2026
Tracked Since May 12, 2026