Local File Inclusion Vulnerability in Trilium Notes by TriliumNext
CVE-2026-35593

6.8MEDIUM

Key Information:

Vendor

Triliumnext

Status
Trilium
Vendor
CVE Published:
19 May 2026

What is CVE-2026-35593?

Trilium Notes, an open-source hierarchical note-taking application, is susceptible to a Local File Inclusion vulnerability that allows an authenticated attacker to access sensitive files on the server's filesystem. Exploitation occurs through the uploadModifiedFileToAttachment function, which processes POST requests to upload and modify attachment files. If an attacker can manipulate the filePath parameter, they may gain access to confidential files, including SSH keys, sensitive credentials, and important configuration files. This exposure can ultimately lead to remote code execution risks and compromise other applications hosted on the same server. Users are advised to upgrade to version 0.102.2, which addresses this critical issue.

Affected Version(s)

Trilium < 0.102.2

References

https://github.com/TriliumNext/Trilium/security/advisorie...
x_refsource_CONFIRM
https://github.com/TriliumNext/Trilium/releases/tag/v0.102.2
x_refsource_MISC

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.