CVE-2023-2110: Obsidian Local File Disclosure

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-08-19 · updated 2026-06-17
Weakness: CWE-22

Description

Improper path handling in Obsidian desktop before 1.2.8 on Windows, Linux and macOS allows a crafted webpage to access local files and exfiltrate them to remote web servers via "app://local/<absolute-path>". This vulnerability can be exploited if a user opens a malicious markdown file in Obsidian, or copies text from a malicious webpage and paste it into Obsidian.

Affected products

Obsidian: before 1.2.8 — fixed in 1.2.8

How to fix

Upgrade to a fixed version: Obsidian 1.2.8. Check the vendor advisory for mitigations.

References

https://obsidian.md/changelog/2023-05-03-desktop-v1.2.8/
https://starlabs.sg/advisories/23/23-2110/
https://obsidian.md/changelog/2023-05-03-desktop-v1.2.8/
https://starlabs.sg/advisories/23/23-2110/

Get alerted when CVE-2023-2110 or the next vulnerability affects your stack