What’s Vulnerable › Products

TriliumNext Trilium vulnerabilities

15 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 14 published in the last 12 months.

Check whether your TriliumNext Trilium version is affected

Latest TriliumNext Trilium vulnerabilities

• CVE-2026-77438 — Trilium unauthenticated share-search discloses password-protected and hidden shared notes (CVSS 7.5)
• CVE-2026-53580 — Trilium arbitrary file read and denial of service via file:// URLs in the automatic image-download feature (CVSS 8.1)
• CVE-2026-53579 — Trilium: Note Import to RCE via Book Note (CVSS 6.1)
• CVE-2026-53578 — Trilium: Note Import to RCE via Mind Elixir dangerouslySetInnerHtml (CVSS 6.1)
• CVE-2026-48996 — Trilium: Malicious import with GeoMap marker title XSS leads to RCE on the desktop client (CVSS 6.1)
• CVE-2026-47727 — Trilium: RCE via `shareTemplate` relation missing `isDangerous` flag — Safe import bypass leading to EJS SSTI (Incomplete Fix of CVE-2026-45668) (CVSS 8.8)
• CVE-2026-45733 — Trilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop app (CVSS 8.3)
• CVE-2026-45668 — Trilium Notes : Note Import to RCE via #docName Path Traversal (Safe Import Enabled) (CVSS 9.3)
• CVE-2026-39311 — Trilium Notes: Stored XSS Leads to Unauthorized Remote Code Execution (RCE) via Unsanitized SVG Attachments (CVSS 6.8)
• CVE-2026-39310 — Trilium Notes: Authentication Bypass in Clipper API for Electron (Desktop) Builds (CVSS 8.6)
• CVE-2026-39309 — Trilium Notes: macOS TCC Bypass via Prompt Spoofing (CVSS 5.5)
• CVE-2026-35593 — Trilium Notes has Local File Inclusion via upload modified file API endpoint (CVSS 6.8)
• CVE-2025-68621 — Trilium Notes has a Timing Attack Vulnerability in /api/login/sync (CVSS 7.4)
• CVE-2025-53544 — Trilium Notes is Vulnerable to Brute-force Protection Bypass via Initial Sync Seed Retrieval (CVSS 7.5)
• CVE-2022-2290 — Cross-site Scripting (XSS) - Reflected in zadam/trilium (CVSS 6.1)