PT-2026-44939 · Unknown · Trilium Notes

Mrdgef · CVE-2026-45668 · Published 2026-05-29 · Updated 2026-07-22

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Trilium Notes versions prior to 0.102.2

Description A malicious ZIP archive imported with safe import enabled can lead to remote code execution (RCE) and cross-site scripting (XSS). This is achieved through path traversal using the #docName label. An attacker combines a payload note (type: code, mime: text/plain) containing raw HTML/JS with a trigger note (type: doc or type: launcher). The trigger note uses ../ path traversal in the #docName label to point to the payload note's API endpoint. Because the desktop client Electron renderer runs with nodeIntegration enabled, the RCE is triggered upon execution of the payload.

Recommendations Update to version 0.102.2.

Exploit

Fix

RCE

Path traversal

XSS

Weakness Enumeration

CWE-22

CWE-79

Related Identifiers

CVE-2026-45668

GHSA-9JJC-CCCQ-F6RH

Affected Products

Trilium Notes

References · 9

• 🔥 https://github.com/TriliumNext/Trilium/security/advisories/GHSA-9jjc-cccq-f6rh · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45668.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-45668 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45668 · Security Note
• https://t.me/CVEtracker/55284 · Telegram Post
• https://twitter.com/CCBalert/status/2061401831142572360 · Twitter Post
• https://twitter.com/infoflowcloud/status/2060840277107962129 · Twitter Post
• https://t.me/cveNotify/211262 · Telegram Post
• https://twitter.com/CVEnew/status/2060839332211053014 · Twitter Post