This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2026-45668 | BDVDB-2026-336609 Detail

TriliumNextTrilium

Description#

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.102.2, a malicious ZIP archive imported with safe import enabled achieves RCE via #docName path traversal and XSS by combining a payload note (type: code, mime: text/plain) containing raw HTML/JS and a trigger note (type: doc or type: launcher) with a #docName label that uses ../ path traversal to point at the payload note's API endpoint. The desktop client Electron renderer runs with nodeIntegration enabled, so an RCE is triggered once the payload is executed. This vulnerability is fixed in 0.102.2.

Impact#

Per CVSS v4.0: confidentiality impact high, integrity impact high, availability impact high. Attack vector: local.

Weaknesses#

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
  • CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.