CVE-2026-45668CWE-22CWE-79

Trilium Notes : Note Import to RCE via #docName Path Traversal (Safe Import Enabled)

Critical · published May 29, 2026

CVSS v4.0
9.3
EPSS
0%
Percentile
10.3
In the wild
Unconfirmed
What it is

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.102.2, a malicious ZIP archive imported with safe import enabled achieves RCE via #docName path traversal and XSS by combining a payload note (type: code, mime: text/plain) containing raw HTML/JS and a trigger note (type: doc or type: launcher) with a #docName label that uses ../ path traversal to point at the payload note's API endpoint. The desktop client Electron renderer runs with nodeIntegration enabled, so an RCE is triggered once the payload is executed. This vulnerability is fixed in 0.102.2.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00207 · 10.3th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-05-29T17:18Z
EPSS history
Timeline
  • 29 MAY 17:18Z
    Trilium Notes : Note Import to RCE via #docName Path Traversal (Safe Import Enabled)
    cvelistv5