PT-2026-38621 · Note Mark · Note Mark

Rvizx · Published 2026-05-07 · Updated 2026-05-14 · CVE-2026-44522

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Note Mark versions 0.13.0 through 0.19.3

Description Authenticated users can upload assets to notes via the "/api/notes/{noteID}/assets" endpoint. The application stores the asset filename provided in the X-Name HTTP request header directly in the database without sanitization, failing to filter path separators or directory traversal sequences.

When an administrator executes the data export CLI commands note-mark migrate export-v1 or note-mark migrate export, the stored filename is used in filepath.Join() and path.Join() calls. Because these functions resolve ../ sequences, an attacker can cause the export process to write files to arbitrary locations on the filesystem. Since the export process often runs with root privileges, this can lead to Remote Code Execution by overwriting critical system binaries like /bin/bash or modifying systemd unit files and cron jobs.

Recommendations Update to version 0.19.4. As a temporary workaround, restrict the use of the X-Name header to ensure it contains no path separators or directory traversal sequences before uploading assets.

Exploit

Fix

Path traversal

RCE

Weakness Enumeration

CWE-22

CWE-20

Related Identifiers

CVE-2026-44522

GHSA-G49P-4QXJ-88V3

Affected Products

Note Mark

References · 5

• 🔥 https://github.com/enchant97/note-mark/security/advisories/GHSA-g49p-4qxj-88v3 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-44522 · Security Note
• https://osv.dev/vulnerability/GHSA-g49p-4qxj-88v3 · Vendor Advisory
• https://github.com/enchant97/note-mark/releases/tag/v0.19.4 · Note
• https://github.com/enchant97/note-mark · Note