Joplin Server EUVD-2026-84169

Requires a Joplin Server instance running with the configuration setting TRANSCRIBE_ENABLED=true - the vulnerable GET/POST /api/transcribe/:id handlers only proxy to the transcription backend when this feature flag is on, so default deployments without transcription are not exposed. The attacker must hold a valid authenticated Joplin Server session (PR:L), and a reachable transcription backend (TRANSCRIBE_BASE_URL) with adjacent internal endpoints (admin/health/config) must exist for the escaped path to return sensitive data. No user interaction is needed. The practical value depends on what those neighboring backend endpoints actually expose.

This is a low-to-moderate real-world risk that maps well to its 4.3 CVSS score rather than being an inflated rating. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N confirms network reachability with low complexity, but PR:L means a valid authenticated Joplin Server account is required, and impact is confidentiality-only (C:L) with no integrity or availability effect. No EPSS score, KEV listing, or public POC was provided, so per the precision rules this is 'no public exploit identified at time of analysis' - there is no signal of active or automated exploitation. A key limiting factor absent from the CVSS vector but explicit in the description is the TRANSCRIBE_ENABLED=true configuration gate: the vulnerable route only exists when the transcription feature is turned on, which is not the default and further narrows the exposed population. The one point worth verifying is the confidentiality magnitude: the description says the proxied backend responses 'potentially' expose administrative, health, or configuration data - if those internal endpoints leak secrets/credentials the real impact could approach C:H, but the vendor rated C:L and the actual sensitivity of the reachable transcription-backend endpoints is not confirmed in the input, so C:L is retained. Overall: a legitimate defensive priority for the small set of self-hosted Joplin Server operators who have transcription enabled, not a broad emergency.

An authenticated user on a Joplin Server instance that has TRANSCRIBE_ENABLED=true sends a request to GET /api/transcribe/:id with a job ID containing URL-encoded slash and parent-directory sequences (e.g. ..%2F..%2Fhealth). parseSubPath() decodes the value and the server builds a backend URL that escapes the /transcribe/ prefix, proxying the request to other transcription-backend endpoints and returning their responses, which may reveal internal administrative, health, or configuration data. No public exploit code was identified, though the fix commit's test cases (..%2Fadmin, ..%2F..%2Fhealth) effectively document the exploitation technique.