Skip to content
Heist/ feed
Back to feed
Critical

Trilium Notes : Note Import to RCE via #docName Path Traversal (Safe Import Enabled)

Type: advisorySources: OSV

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.102.2, a malicious ZIP archive imported with safe import enabled achieves RCE via #docName path traversal and XSS by combining a payload note (type: code, mime: text/plain) containing raw HTML/JS and a trigger note (type: doc or type: launcher) with a #docName label that uses ../ path traversal to point at the payload note's API endpoint. The desktop client Electron renderer runs with nodeIntegration enabled, so an RCE is triggered once the payload is executed. This vulnerability is fixed in 0.102.2.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-45668
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 17:11 UTC · Revision 1

Source evidence

Trilium Notes : Note Import to RCE via #docName Path Traversal (Safe Import Enabled)

core-osv · Original source

Published 29 May 2026, 17:18 UTC

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.102.2, a malicious ZIP archive imported with safe import enabled achieves RCE via #docName path traversal and XSS by combining a payload note (type: code, mime: text/plain) containing raw HTML/JS and a trigger note (type: doc or type: launcher) with a #docName label that uses ../ path traversal to point at the payload note's API endpoint. The desktop client Electron renderer runs with nodeIntegration enabled, so an RCE is triggered once the payload is executed. This vulnerability is fixed in 0.102.2.

osv:CVE-2026-45668
Complete source record
{
  "id": "b07caa2b278afc77e5799ee5cd51c586d63ffa2b508a1a6a83cb4c5b02de511b",
  "url": "https://osv.dev/vulnerability/CVE-2026-45668",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Trilium Notes : Note Import to RCE via #docName Path Traversal (Safe Import Enabled)",
    "summary": "Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.102.2, a malicious ZIP archive imported with safe import enabled achieves RCE via #docName path traversal and XSS by combining a payload note (type: code, mime: text/plain) containing raw HTML/JS and a trigger note (type: doc or type: launcher) with a #docName label that uses ../ path traversal to point at the payload note's API endpoint. The desktop client Electron renderer runs with nodeIntegration enabled, so an RCE is triggered once the payload is executed. This vulnerability is fixed in 0.102.2.",
    "evidence": "osv:CVE-2026-45668",
    "products": [],
    "severity": "critical",
    "structured": {
      "id": "CVE-2026-45668",
      "aliases": [
        "CVE-2026-45668",
        "GHSA-9jjc-cccq-f6rh"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/triliumnext/trilium",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "bf234397923e912b4f8c5b898ab79aa37f5cc286"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "0.102.2"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "0.102.2"
                      }
                    ],
                    "source": "DESCRIPTION"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v0.102.1",
            "v0.102.0",
            "web-clipper-v1.1.1",
            "web-clipper-v1.1.0",
            "v0.101.1",
            "v0.99.4",
            "v0.99.2",
            "v0.99.0",
            "v0.98.1",
            "v0.98.0",
            "v0.97.0",
            "v0.97.2",
            "v0.96.0",
            "v0.63.6",
            "v0.62.2",
            "v0.62.1-beta",
            "v0.62.0-beta",
            "v0.61.4-beta",
            "v0.61.3-beta",
            "v0.61.2-beta",
            "v0.61.1-beta",
            "v0.61.0-beta",
            "v0.59.1",
            "v0.59.0-beta",
            "v0.58.0-beta",
            "v0.57.3",
            "v0.57.2",
            "v0.57.1-beta",
            "v0.57.0-beta",
            "v0.56.1",
            "v0.56.0-beta",
            "v0.55.1",
            "v0.55.0-beta",
            "v0.54.1-beta",
            "v0.54.0-beta",
            "v0.53.2",
            "v0.53.1-beta",
            "v0.53.0-beta",
            "v0.52.2",
            "v0.52.1-beta",
            "v0.52.0-beta",
            "v0.51.2",
            "v0.51.1-beta",
            "v0.51.0-beta",
            "v0.50.1",
            "v0.50.0-beta",
            "v0.49.4",
            "v0.49.3",
            "v0.49.2-beta",
            "v0.49.1-beta",
            "v0.49.0-beta",
            "v0.48.6.1",
            "v0.48.6-docker",
            "v0.48.6",
            "v0.48.5",
            "v0.48.4",
            "v0.48.3",
            "v0.48.2",
            "v0.48.1-beta",
            "v0.48.0-beta",
            "v0.47.0-beta",
            "v0.46.3-beta",
            "v0.46.2-beta",
            "v0.46.1-beta",
            "v0.46.0-beta",
            "v0.44.4",
            "v0.44.3-beta",
            "v0.44.2-beta",
            "v0.44.1-beta",
            "v0.44.0-beta",
            "v0.42.1",
            "v0.42.0-beta",
            "v0.41.6",
            "v0.41.5",
            "v0.41.4-beta",
            "v0.41.3-beta",
            "0.41.3",
            "v0.41.2-beta",
            "v0.41.1-beta",
            "v0.41.0-beta",
            "v0.40.0-beta",
            "v0.39.3",
            "v0.39.2-beta",
            "v0.39.1-beta",
            "v0.39.0-beta",
            "v0.38.2",
            "v0.38.1-beta",
            "v0.38.0-beta",
            "v0.37.2",
            "v0.37.1-beta",
            "v0.37.0-beta",
            "v0.36.1-beta",
            "v0.36.0-beta",
            "v0.35.1",
            "v0.35.0-beta",
            "v0.34.1",
            "v0.34.0-beta",
            "v0.33.3",
            "v0.33.2-beta",
            "v0.33.1-beta",
            "v0.33.0-beta",
            "v0.32.3",
            "v0.32.2-beta",
            "v0.32.1-beta",
            "v0.32.0-beta",
            "v0.31.3",
            "v0.31.2-beta",
            "v0.31.1-beta",
            "v0.31.0-beta",
            "v0.30.3-beta",
            "v0.30.2-beta",
            "v0.30.1-beta",
            "v0.30.0-beta",
            "v0.29.1",
            "v0.29.0-beta",
            "v0.28.3",
            "v0.28.2",
            "v0.28.1-beta",
            "v0.28.0-beta",
            "v0.27.4",
            "v0.27.3",
            "v0.27.2-beta",
            "v0.27.1-beta",
            "v0.27.0-beta",
            "v0.26.1",
            "v0.26.0-beta",
            "v0.25.1-beta",
            "v0.25.0-beta",
            "v0.24.5",
            "v0.24.4-beta",
            "v0.24.3-beta",
            "v0.24.2-beta",
            "v0.24.1-beta",
            "v0.24.0-beta",
            "v0.23.0",
            "v0.22.1",
            "v0.22.0",
            "v0.21.0",
            "v0.20.2",
            "v0.20.1",
            "v0.20.0",
            "v0.19.1",
            "v0.19.0",
            "v0.18.0",
            "v0.17.0",
            "v0.16.0",
            "v0.15.0",
            "v0.14.1",
            "v0.14.0",
            "v0.13.0-beta",
            "v0.11.1",
            "v0.11.0-beta",
            "v0.10.2-beta",
            "v0.10.1-beta",
            "v0.10.0-beta",
            "v0.8.1",
            "v0.8.0-beta",
            "v0.7.0-beta",
            "v0.6.1",
            "v0.6.0-beta",
            "v0.5.5-beta",
            "v0.5.4-beta",
            "v0.5.3-beta",
            "v0.5.2-beta",
            "v0.5.1-beta",
            "v0.5.0-beta",
            "v0.4.1",
            "v0.4.0-beta",
            "v0.3.2",
            "v0.3.1",
            "v0.3.0",
            "v0.2.2",
            "v0.2.1",
            "v0.2.0",
            "v0.1.2",
            "v0.1.1",
            "v0.1.0",
            "v0.0.11",
            "v0.0.10",
            "v0.0.9"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45668.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:37.727608634Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45668.json",
        "https://github.com/TriliumNext/Trilium/security/advisories/GHSA-9jjc-cccq-f6rh",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-45668"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-22",
          "CWE-79"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45668.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-45668",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 505181,
  "published_at": "2026-05-29T17:18:28.997+00:00"
}