What is the CVSS score of EUVD-2026-29329?

EUVD-2026-29329 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for EUVD-2026-29329?

Yes, a patch is available for EUVD-2026-29329. Update the affected software to the latest version immediately.

Jotty EUVD-2026-29329

| CVE-2026-42564 HIGH

Path Traversal (CWE-22)

2026-05-11 GitHub_M

Path Traversal Jotty

8.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

May 11, 2026 - 23:03 EUVD

CVE Published

May 11, 2026 - 21:17 nvd

HIGH 8.2

DescriptionGitHub Advisory

jotty·page is a self-hosted app for your checklists and notes. Prior to 1.22.0, an unauthenticated path traversal vulnerability exists in /api/app-icons/[filename]. The filename route parameter is joined into a filesystem path without traversal/boundary validation, allowing file reads outside data/uploads/app-icons/. This vulnerability is fixed in 1.22.0.