jotty - Path Traversal (CVE-2026-42564)
Description
jotty·page is a self-hosted app for your checklists and notes. Prior to 1.22.0, an unauthenticated path traversal vulnerability exists in /api/app-icons/[filename]. The filename route parameter is joined into a filesystem path without traversal/boundary validation, allowing file reads outside data/uploads/app-icons/. This vulnerability is fixed in 1.22.0.
psychologyCrowdSec Analysis
CVE-2026-42564 is a high-severity path traversal vulnerability in jotty versions before 1.22.0. Unauthenticated remote attackers can exploit the app-icons filename route to read files outside the intended directory, potentially exposing sensitive data; the issue is fixed in version 1.22.0.
CrowdSec has been tracking this vulnerability and its exploits since 23rd of October 2026.
CrowdSec network observations suggest that most exploitation of CVE-2026-42564 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. In addition, according to the CrowdSec network, attack volume against CVE-2026-42564 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.
Attackers target /api/app-icons/ with a filename containing encoded directory traversal sequences such as ..%2F to access files outside the intended directory. The template probes for /etc/passwd to confirm arbitrary file access.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2026-05-11 |
| Rule Released | 2026-10-23 |
| CrowdSec First Seen | 2026-10-28 |
Related Weaknesses
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.