Vulnerability details
CVE-2026-45668
TriliumNext Trilium
Trilium Notes : Note Import to RCE via #docName Path Traversal (Safe Import Enabled)
CVSS 4.0
9.3Critical
Official description
Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.102.2, a malicious ZIP archive imported with safe import enabled achieves RCE via #docName path traversal and XSS by combining a payload note (type: code, mime: text/plain) containing raw HTML/JS and a trigger note (type: doc or type: launcher) with a #docName label that uses ../ path traversal to point at the payload note's API endpoint. The desktop client Electron renderer runs with nodeIntegration enabled, so an RCE is triggered once the payload is executed. This vulnerability is fixed in 0.102.2.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.3Critical | 4.0 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| TriliumNext | Trilium | < 0.102.2 | CVEProject cvelistV5 (CNA) |
References and advisories
1- https://github.com/TriliumNext/Trilium/security/advisories/GHSA-9jjc-cccq-f6rh x_refsource_CONFIRM
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-05-29
- Last updated
- 2026-05-29
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.17%
Probability of exploitation in 30 days
6.4%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- Proof of concept
- Technical impact
- Total
Weaknesses (CWE)
- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')