CVE-2026-45668

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-45668
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45668.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-45668
Aliases
  • GHSA-9jjc-cccq-f6rh
Published
2026-05-29T17:18:28.997Z
Modified
2026-08-12T03:51:28.053976825Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CVSS Calculator
Summary
Trilium Notes : Note Import to RCE via #docName Path Traversal (Safe Import Enabled)
Details

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.102.2, a malicious ZIP archive imported with safe import enabled achieves RCE via #docName path traversal and XSS by combining a payload note (type: code, mime: text/plain) containing raw HTML/JS and a trigger note (type: doc or type: launcher) with a #docName label that uses ../ path traversal to point at the payload note's API endpoint. The desktop client Electron renderer runs with nodeIntegration enabled, so an RCE is triggered once the payload is executed. This vulnerability is fixed in 0.102.2.

Database specific 
{
    "cwe_ids": [
        "CWE-22",
        "CWE-79"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45668.json"
}
References

Affected packages

Git / github.com/triliumnext/trilium

Affected ranges

Type
GIT
Repo
https://github.com/triliumnext/trilium
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
bf234397923e912b4f8c5b898ab79aa37f5cc286
Database specific
Show details 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.102.2"
        }
    ]
}

Affected versions

0.*
0.41.3
v0.*
v0.0.10
v0.0.11
v0.0.9
v0.1.0
v0.1.1
v0.1.2
v0.10.0-beta
v0.10.1-beta
v0.10.2-beta
v0.101.1
v0.102.0
v0.102.1
v0.11.0-beta
v0.11.1
v0.13.0-beta
v0.14.0
v0.14.1
v0.15.0
v0.16.0
v0.17.0
v0.18.0
v0.19.0
v0.19.1
v0.2.0
v0.2.1
v0.2.2
v0.20.0
v0.20.1
v0.20.2
v0.21.0
v0.22.0
v0.22.1
v0.23.0
v0.24.0-beta
v0.24.1-beta
v0.24.2-beta
v0.24.3-beta
v0.24.4-beta
v0.24.5
v0.25.0-beta
v0.25.1-beta
v0.26.0-beta
v0.26.1
v0.27.0-beta
v0.27.1-beta
v0.27.2-beta
v0.27.3
v0.27.4
v0.28.0-beta
v0.28.1-beta
v0.28.2
v0.28.3
v0.29.0-beta
v0.29.1
v0.3.0
v0.3.1
v0.3.2
v0.30.0-beta
v0.30.1-beta
v0.30.2-beta
v0.30.3-beta
v0.31.0-beta
v0.31.1-beta
v0.31.2-beta
v0.31.3
v0.32.0-beta
v0.32.1-beta
v0.32.2-beta
v0.32.3
v0.33.0-beta
v0.33.1-beta
v0.33.2-beta
v0.33.3
v0.34.0-beta
v0.34.1
v0.35.0-beta
v0.35.1
v0.36.0-beta
v0.36.1-beta
v0.37.0-beta
v0.37.1-beta
v0.37.2
v0.38.0-beta
v0.38.1-beta
v0.38.2
v0.39.0-beta
v0.39.1-beta
v0.39.2-beta
v0.39.3
v0.4.0-beta
v0.4.1
v0.40.0-beta
v0.41.0-beta
v0.41.1-beta
v0.41.2-beta
v0.41.3-beta
v0.41.4-beta
v0.41.5
v0.41.6
v0.42.0-beta
v0.42.1
v0.44.0-beta
v0.44.1-beta
v0.44.2-beta
v0.44.3-beta
v0.44.4
v0.46.0-beta
v0.46.1-beta
v0.46.2-beta
v0.46.3-beta
v0.47.0-beta
v0.48.0-beta
v0.48.1-beta
v0.48.2
v0.48.3
v0.48.4
v0.48.5
v0.48.6
v0.48.6-docker
v0.48.6.1
v0.49.0-beta
v0.49.1-beta
v0.49.2-beta
v0.49.3
v0.49.4
v0.5.0-beta
v0.5.1-beta
v0.5.2-beta
v0.5.3-beta
v0.5.4-beta
v0.5.5-beta
v0.50.0-beta
v0.50.1
v0.51.0-beta
v0.51.1-beta
v0.51.2
v0.52.0-beta
v0.52.1-beta
v0.52.2
v0.53.0-beta
v0.53.1-beta
v0.53.2
v0.54.0-beta
v0.54.1-beta
v0.55.0-beta
v0.55.1
v0.56.0-beta
v0.56.1
v0.57.0-beta
v0.57.1-beta
v0.57.2
v0.57.3
v0.58.0-beta
v0.59.0-beta
v0.59.1
v0.6.0-beta
v0.6.1
v0.61.0-beta
v0.61.1-beta
v0.61.2-beta
v0.61.3-beta
v0.61.4-beta
v0.62.0-beta
v0.62.1-beta
v0.62.2
v0.63.6
v0.7.0-beta
v0.8.0-beta
v0.8.1
v0.96.0
v0.97.0
v0.97.2
v0.98.0
v0.98.1
v0.99.0
v0.99.2
v0.99.4
web-clipper-v1.*
web-clipper-v1.1.0
web-clipper-v1.1.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45668.json"