What is the CVSS score of EUVD-2026-29329?

EUVD-2026-29329 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of Jotty are affected by EUVD-2026-29329?

Jotty (fccview's self-hosted checklist/notes app) versions before 1.22.0 contain an unauthenticated file read vulnerability allowing remote attackers to access arbitrary files on the server,…. A patch is available.

How to fix or mitigate EUVD-2026-29329?

Within 24 hours, inventory all Jotty deployments and identify instances running versions prior to 1.22.0. Within 7 days, upgrade all affected instances to version 1.22.0 or later, testing thoroughly in a staging environment before production deployment. Within 30 days, complete a retrospective audit of access logs to detect unauthorized file reads and verify that all instances have been successfully patched.

Jotty EUVD-2026-29329

| CVE-2026-42564 HIGH

Path Traversal (CWE-22)

2026-05-11 GitHub_M

Path Traversal Jotty

8.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

7.5 HIGH

Unauthenticated, network-reachable, low-complexity file read gives AV:N/AC:L/PR:N/UI:N and C:H; a read-only traversal yields no integrity or availability impact, so I:N/A:N (unlike the input's I:L).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 23:31 vuln.today

Patch available

May 11, 2026 - 23:03 EUVD

CVE Published

May 11, 2026 - 21:17 nvd

HIGH 8.2

DescriptionGitHub Advisory

jotty·page is a self-hosted app for your checklists and notes. Prior to 1.22.0, an unauthenticated path traversal vulnerability exists in /api/app-icons/[filename]. The filename route parameter is joined into a filesystem path without traversal/boundary validation, allowing file reads outside data/uploads/app-icons/. This vulnerability is fixed in 1.22.0.

AnalysisAI

Arbitrary file read in Jotty (fccview's self-hosted checklist and notes app) lets unauthenticated remote attackers escape the app-icons directory. Versions before 1.22.0 pass the filename route parameter of /api/app-icons/[filename] directly into a filesystem path without boundary validation, so crafted traversal sequences read files outside data/uploads/app-icons/. No public exploit identified at time of analysis and EPSS is low (0.05%), but the flaw is network-reachable with no authentication and is trivially automatable.

Technical ContextAI

Jotty is a Node/Next.js-style self-hosted web application for personal checklists and notes, published by the vendor 'fccview' (cpe:2.3:a:fccview:jotty). The vulnerable endpoint /api/app-icons/[filename] serves uploaded application icons from data/uploads/app-icons/. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, 'Path Traversal'): the dynamic [filename] route segment is concatenated/joined into a server-side file path and used to read from disk without normalizing the result or verifying it remains within the intended base directory. Because typical path-join operations resolve '../' sequences, a filename containing traversal components resolves to arbitrary locations on the host filesystem, and the handler returns the file contents in the HTTP response.

RemediationAI

Vendor-released patch: upgrade Jotty to 1.22.0 or later, which adds traversal/boundary validation to the /api/app-icons/[filename] handler; see the advisory at https://github.com/fccview/jotty/security/advisories/GHSA-7843-gwq8-g96f. If an immediate upgrade is not possible, place the instance behind a reverse proxy or WAF rule that rejects requests to /api/app-icons/ whose filename contains traversal sequences ('..', encoded '%2e%2e', backslashes, or absolute paths) - trade-off: encoding-normalization gaps can be bypassed, so treat this as stop-gap only. Additionally restrict network exposure of the app (bind to localhost/VPN or IP allowlist) since the endpoint is unauthenticated, and run the Jotty process as a low-privilege user in a container with a minimal filesystem view so a successful traversal reads as little host data as possible. Rotate any secrets (session keys, API tokens, credentials in config or the data store) that a pre-patch exposure window could have leaked.