PT-2026-44939 · Triliumnext · Trilium

Published 2026-05-29 · Updated 2026-05-29 · CVE-2026-45668

NVD

CVSS v4.0

9.3

Critical

Base vector

AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.102.2, a malicious ZIP archive imported with safe import enabled achieves RCE via #docName path traversal and XSS by combining a payload note (type: code, mime: text/plain) containing raw HTML/JS and a trigger note (type: doc or type: launcher) with a #docName label that uses ../ path traversal to point at the payload note's API endpoint. The desktop client Electron renderer runs with nodeIntegration enabled, so an RCE is triggered once the payload is executed. This vulnerability is fixed in 0.102.2.

Exploit

Fix

Path traversal

XSS

Weakness Enumeration

CWE-22

CWE-79

Related Identifiers

CVE-2026-45668

Affected Products

Trilium

References · 2

• 🔥 https://github.com/TriliumNext/Trilium/security/advisories/GHSA-9jjc-cccq-f6rh · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-45668 · Security Note