by Kastro
Paper/Archive/CVE-2026-45668

CVE-2026-45668

TriliumNext Trilium — Trilium Notes : Note Import to RCE via #docName Path Traversal (Safe Import Enabled)

EPSS 0.2%public exploitCVSS 9.3
critical.is priorityof 100
39
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 6.4.064 × 201.3Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.102.2, a malicious ZIP archive imported with safe import enabled achieves RCE via #docName path traversal and XSS by combining a payload note (type: code, mime: text/plain) containing raw HTML/JS and a trigger note (type: doc or type: launcher) with a #docName label that uses ../ path traversal to point at the payload note's API endpoint. The desktop client Electron renderer runs with nodeIntegration enabled, so an RCE is triggered once the payload is executed. This vulnerability is fixed in 0.102.2.

Affected

ProductAffectedFixed inSource
Trilium< 0.102.2–CNA

Scores by source

GitHub_M (CNA)9.3CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgithub.com/TriliumNext/Trilium/security/advisories/GHSA-9jjc-cccq-f6rh