Medium
Security advisory
Joplin through 1.0.184 allows Arbitrary File Read via XSS.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-9038
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 10:58 UTC · Revision 1
Source evidence
Joplin through 1.0.184 allows Arbitrary File Read via XSS.
osv:CVE-2020-9038
Complete source record
{
"id": "9fdc40554ca5050283858b0803c26e5f26e2328d8282a90c2436f175ad0c1d9a",
"url": "https://osv.dev/vulnerability/CVE-2020-9038",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-9038",
"summary": "Joplin through 1.0.184 allows Arbitrary File Read via XSS.",
"evidence": "osv:CVE-2020-9038",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2020-9038",
"aliases": [
"CVE-2020-9038",
"GHSA-6r7x-hc8m-985r"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/laurent22/joplin",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "56cf5271a2385fea1c63bb31b4f4761ff52baa86"
},
{
"fixed": "3db47b575b9cb0a765da3d283baa2c065df0d0bc"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:joplin_project:joplin:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "1.0.184"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "3db47b575b9cb0a765da3d283baa2c065df0d0bc"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v1.0.184",
"v1.0.183",
"v1.0.182",
"cli-v1.0.154",
"ios-v10.0.43",
"android-v1.0.316",
"v1.0.179",
"v1.0.178",
"android-v1.0.315",
"v1.0.177",
"android-v1.0.314",
"android-v1.0.313",
"v1.0.176",
"ios-v10.0.41",
"android-v1.0.312",
"v1.0.175",
"android-v1.0.311",
"ios-v10.0.40",
"v1.0.174",
"clipper-1.0.19",
"cli-v1.0.150",
"ios-v10.0.39",
"v1.0.172",
"android-v1.0.310",
"v1.0.171",
"android-v1.0.309",
"android-v1.0.308",
"v1.0.170",
"cli-v1.0.149",
"cli-v1.0.148",
"android-v1.0.307",
"v1.0.169",
"cli-v1.0.147",
"android-v1.0.306",
"v1.0.168",
"ios-v10.0.37",
"android-v1.0.305",
"v1.0.167",
"android-v1.0.304",
"v1.0.166",
"cli-v1.0.146",
"cli-v1.0.145",
"android-v1.0.303",
"android-v1.0.299",
"v1.0.165",
"v1.0.164",
"v1.0.163",
"android-v1.0.294",
"v1.0.162",
"cli-v1.0.141",
"android-v1.0.293",
"android-v1.0.292",
"android-v1.0.291",
"android-v1.0.290",
"android-v1.0.289",
"android-v1.0.284",
"android-v1.0.283",
"android-v1.0.281",
"v1.0.161",
"android-v1.0.279",
"android-v1.0.277",
"clipper-1.0.17",
"android-v1.0.276",
"ios-v10.0.35",
"android-v1.0.271",
"android-v1.0.269",
"v1.0.160",
"android-v1.0.261",
"v1.0.159",
"android-v1.0.260",
"cli-v1.0.139",
"v1.0.158",
"android-v1.0.255",
"android-v1.0.254",
"v1.0.157",
"v1.0.156",
"android-v1.0.253",
"v1.0.155",
"v1.0.154",
"cli-v1.0.137",
"cli-v1.0.136",
"v1.0.153",
"cli-v1.0.135",
"cli-v1.0.133",
"cli-v1.0.129",
"cli-v1.0.128",
"cli-v1.0.127",
"ios-v10.0.34",
"android-v1.0.252",
"v1.0.152",
"cli-v1.0.126",
"clipper-1.0.14",
"ios-v10.0.33",
"android-v1.0.251",
"v1.0.151",
"android-v1.0.248",
"v1.0.150",
"v1.0.149",
"ios-v10.0.31",
"android-v1.0.243",
"v1.0.143",
"v1.0.142",
"clipper-1.0.13",
"clipper-1.0.12",
"clipper-1.0.10",
"android-v1.0.242",
"cli-v1.0.124",
"android-v1.0.241",
"v1.0.140",
"android-v1.0.240",
"v1.0.139",
"v1.0.138",
"v1.0.137",
"v1.0.136",
"v1.0.135",
"v1.0.134",
"v1.0.133",
"ios-v10.0.30",
"v1.0.132",
"v1.0.131",
"android-v1.0.239",
"v1.0.130",
"v1.0.129",
"android-v1.0.238",
"v1.0.128",
"android-v1.0.237",
"v1.0.127",
"cli-v1.0.123",
"cli-v1.0.122",
"v1.0.126",
"ios-v10.0.29",
"v1.0.125",
"android-v1.0.236",
"android-v1.0.234",
"v1.0.123",
"android-v1.0.233",
"v1.0.120",
"cli-v1.0.120",
"android-v1.0.232",
"android-v1.0.225",
"android-v1.0.224",
"android-v1.0.201",
"android-v1.0.200",
"android-v1.0.181",
"clipper-1.0.8",
"android-v1.0.179",
"ios-v10.0.27",
"android-v1.0.178",
"v1.0.119",
"android-v1.0.177",
"v1.0.118",
"v1.0.117",
"cli-v1.0.118",
"android-v1.0.176",
"v1.0.116",
"v1.0.115",
"cli-v1.0.117",
"android-v1.0.175",
"v1.0.114",
"android-v1.0.151",
"android-v1.0.148",
"v1.0.113",
"android-v1.0.142",
"v1.0.112",
"android-v1.0.141",
"android-v1.0.140",
"android-v1.0.138",
"v1.0.111",
"android-v1.0.135",
"v1.0.110",
"cli-v1.0.115",
"clipper-1.0.7",
"android-v1.0.133",
"v1.0.109",
"v1.0.108",
"android-v1.0.132",
"v1.0.107",
"v1.0.106",
"cli-v1.0.114",
"android-v1.0.131",
"v1.0.105",
"cli-v1.0.113",
"cli-v1.0.110",
"cli-v1.0.109",
"android-v1.0.129",
"v1.0.104",
"v1.0.103",
"untagged-6ad6c38d382d9cf912e5",
"android-v1.0.128",
"v1.0.102",
"v1.0.101",
"cli-v1.0.108",
"android-v1.0.127",
"v1.0.100",
"v1.0.99",
"v1.0.98",
"v1.0.97",
"v1.0.96",
"v1.0.95",
"v1.0.94",
"ios-v10.0.22",
"v1.0.93",
"v1.0.92",
"android-v1.0.125",
"cli-v1.0.107",
"v1.0.91",
"android-v1.0.124",
"v1.0.90",
"android-v1.0.123",
"ios-v10.0.21",
"android-v1.0.122",
"v1.0.89",
"v1.0.88",
"v1.0.87",
"android-v1.0.120",
"v1.0.86",
"v1.0.85",
"v1.0.84",
"android-v1.0.119",
"android-v1.0.118",
"cli-v1.0.106",
"v1.0.83",
"v1.0.82",
"android-v1.0.116",
"v1.0.81",
"android-v1.0.115",
"android-v1.0.103",
"cli-v1.0.100",
"v1.0.70",
"v1.0.69",
"v1.0.68",
"android-v1.0.102",
"ios-v1.0.13",
"cli-v1.0.99",
"v1.0.67",
"android-v1.0.101",
"android-v1.0.100",
"v1.0.66",
"cli-v1.0.98",
"cli-v1.0.97",
"cli-v1.0.96",
"v1.0.64",
"android-v1.0.98",
"android-v1.0.97",
"v1.0.63",
"cli-v1.0.95",
"android-v1.0.95",
"v1.0.62",
"android-v1.0.94",
"android-v0.10.92",
"v0.10.61",
"android-v0.10.91",
"android-v0.10.90",
"android-v0.10.89",
"android-v0.10.88",
"cli-v0.10.93",
"android-v0.10.86",
"v0.10.60",
"v0.10.59",
"android-v0.10.85",
"v0.10.58",
"v0.10.57",
"android-v0.10.83",
"v0.10.56",
"v0.10.55",
"cli-v0.10.87",
"android-v0.10.71",
"v0.10.43",
"v0.10.42",
"cli-v0.10.86",
"android-v0.10.69",
"v0.10.41",
"ios-v0.10.6",
"v0.10.38",
"android-v0.10.65",
"v0.10.37",
"v0.10.36",
"android-v0.10.62",
"v0.10.35",
"v0.10.34",
"v0.10.33",
"v0.10.32",
"v0.10.31",
"android-v0.10.61",
"v0.10.30",
"v0.10.29",
"v0.10.28",
"v0.10.27",
"v0.10.26"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-9038.json"
}
}
],
"modified": "2026-10-20T10:52:15.690537860Z",
"provider": "osv",
"references": [
"https://github.com/laurent22/joplin/commit/3db47b575b9cb0a765da3d283baa2c065df0d0bc",
"https://github.com/laurent22/joplin/compare/clipper-1.0.19...clipper-1.0.20"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2020-9038",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 383508,
"published_at": "2020-02-17T16:15:28.867+00:00"
}