# CVE-2026-42564: jotty - Path Traversal

> Live exploitation tracking for CVE-2026-42564 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-42564

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 8.2
- **Public exploit available:** Yes
- **Affected products:** Fccview jotty
- **Weaknesses:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')); CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
- **Tags:** web_application

## Description

jotty·page is a self-hosted app for your checklists and notes. Prior to 1.22.0, an unauthenticated path traversal vulnerability exists in /api/app-icons/[filename]. The filename route parameter is joined into a filesystem path without traversal/boundary validation, allowing file reads outside data/uploads/app-icons/. This vulnerability is fixed in 1.22.0.

## CrowdSec analysis

[CVE-2026-42564](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-42564) is a high-severity path traversal vulnerability in jotty versions before 1.22.0. Unauthenticated remote attackers can exploit the app-icons filename route to read files outside the intended directory, potentially exposing sensitive data; the issue is fixed in version 1.22.0.

CrowdSec has been tracking this vulnerability and its exploits since 23rd of October 2026.

CrowdSec network observations suggest that most exploitation of CVE-2026-42564 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental.
In addition, according to the CrowdSec network, attack volume against CVE-2026-42564 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers target `/api/app-icons/` with a filename containing encoded directory traversal sequences such as `..%2F` to access files outside the intended directory. The template probes for `/etc/passwd` to confirm arbitrary file access.

## Timeline

- 2026-05-11: CVE Published. CVE-2026-42564 is published to NVD.
- 2026-10-23: Rule Released. CrowdSec releases a rule to detect CVE-2026-42564 exploitation attempts against the CrowdSec Network.
- 2026-10-28: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-42564 for the first time.

## References

- https://github.com/fccview/jotty/security/advisories/GHSA-7843-gwq8-g96f
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-42564.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-42564) follows observed exploitation activity for CVE-2026-42564. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.