Description
jotty·page is a self-hosted app for your checklists and notes. Prior to 1.22.0, an unauthenticated path traversal vulnerability exists in /api/app-icons/[filename]. The filename route parameter is joined into a filesystem path without traversal/boundary validation, allowing file reads outside data/uploads/app-icons/. This vulnerability is fixed in 1.22.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| fccview | jotty | < 1.22.0 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- jotty.page < 1.22.0 - Path Traversal http/cves/2026/CVE-2026-42564.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.