What’s Vulnerable › Vulnerabilities

CVE-2026-45668: Trilium Notes : Note Import to RCE via #docName Path Traversal (Safe Import Enabled)

• Severity: critical (CVSS 9.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-29 · updated 2026-07-22
• Weakness: CWE-22

Description

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.102.2, a malicious ZIP archive imported with safe import enabled achieves RCE via #docName path traversal and XSS by combining a payload note (type: code, mime: text/plain) containing raw HTML/JS and a trigger note (type: doc or type: launcher) with a #docName label that uses ../ path traversal to point at the payload note's API endpoint. The desktop client Electron renderer runs with nodeIntegration enabled, so an RCE is triggered once the payload is executed. This vulnerability is fixed in 0.102.2.

Affected products

• TriliumNext Trilium: before 0.102.2

References

• https://github.com/TriliumNext/Trilium/security/advisories/GHSA-9jjc-cccq-f6rh
• https://github.com/TriliumNext/Trilium/security/advisories/GHSA-9jjc-cccq-f6rh

Get alerted when CVE-2026-45668 or the next vulnerability affects your stack