PT-2026-42024 · Unknown · Trilium Notes

Umeradeemcheema · Published 2026-05-19 · Updated 2026-05-20 · CVE-2026-35593

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Trilium Notes versions prior to 0.102.2

Description An authenticated attacker can perform Local File Inclusion, which is a flaw allowing the reading of arbitrary files on the server's filesystem. The issue occurs within the uploadModifiedFileToAttachment() function, triggered by a POST request to the '/api/attachments/{attachmentId}/upload-modified-file' endpoint. By providing a path in the filePath variable of the request body, the content of an attachment is replaced with the content of the specified file. The attacker can then retrieve this content via the '/api/attachments/{attachmentId}/download' endpoint. This can expose sensitive data such as SSH keys, credentials, configurations, and operating system files, potentially leading to remote code execution and the compromise of co-hosted applications.

Recommendations Update to version 0.102.2. As a temporary workaround, restrict access to the '/api/attachments/{attachmentId}/upload-modified-file' endpoint.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-73

CWE-22

Related Identifiers

CVE-2026-35593

Affected Products

Trilium Notes

References · 4

• 🔥 https://github.com/TriliumNext/Trilium/security/advisories/GHSA-hf4x-22rg-pjjp · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-35593 · Security Note
• https://github.com/TriliumNext/Trilium/releases/tag/v0.102.2 · Note
• https://twitter.com/CVEnew/status/2056994211309006950 · Twitter Post