CVE-2026-53580

Received Received - Intake

Local File Read in Trilium Notes via file:// URL

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: GitHub, Inc.

Description

Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the automatic image-download feature accepts file:// URLs in a note's img tags and reads the referenced local file with no path validation, allowing any authenticated user to disclose arbitrary files readable by the Trilium process. When a text note is saved, Trilium scans its HTML for image sources and downloads each external one; because the HTML sanitizer keeps file as an allowed scheme, a source such as file:///etc/passwd is passed straight to a filesystem read and its contents are stored as a note attachment the user can then retrieve. Pointing the same primitive at an unbounded source such as /dev/zero causes uncontrolled memory allocation that crashes the server process. The feature is enabled by default and is reachable through the web UI, the ETAPI, the web clipper, and note imports, requiring only an authenticated session or an ETAPI token. This issue is fixed in version 0.104.0

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-08-27

Generated

2026-08-28

AI Q&A

2026-08-28

EPSS Evaluated

N/A

NVD

CVE-2026-53580

Affected Vendors & Products

Vendor	Product	Version / Range
triliumnext	trilium	to 0.104.0 (exc)
trilium	trilium	to 0.104.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.
CWE-552	The product makes files or directories accessible to unauthorized actors, even though they should not be.

Attack-Flow Graph

Executive Summary

CVE-2026-53580 is a file disclosure and denial-of-service vulnerability in Trilium versions prior to 0.104.0. It occurs because the application accepts file:// URLs in note image tags without proper validation. When a note is saved, Trilium reads the referenced local file and stores its contents as a note attachment. Attackers can exploit this to read sensitive files like /etc/passwd or cause the server to crash by pointing to /dev/zero.

Detection Guidance

Check Trilium version with 'curl -s http://localhost:8080/api/version | grep version' or 'docker exec <container> cat /home/node/app/package.json | grep version'. If version is below 0.104.0, the system is vulnerable. Inspect note content for img tags with file:// URLs like '<img src="file:///etc/passwd">' in saved notes or API responses.

Monitor server logs for OOM crashes or unusual file access patterns. Use 'journalctl -u trilium -n 100 --no-pager' or 'docker logs <container> --tail 100' to check for crashes or errors related to file operations.

Impact Analysis

This vulnerability allows any authenticated user to disclose arbitrary files accessible to the Trilium process, including sensitive configuration files. It can also cause the server to crash due to uncontrolled memory allocation when targeting unbounded sources like /dev/zero. Additionally, extracted session secrets may enable persistent unauthorized access even after password changes.

Mitigation Strategies

Upgrade Trilium to version 0.104.0 or later immediately. Disable the automatic image-download feature if not required by setting the environment variable 'DISABLE_AUTO_IMAGE_DOWNLOAD=true' or modifying the config file.

Restrict network access to Trilium instances to trusted users only. Rotate session secrets and credentials if they may have been exposed via file disclosure. Monitor for unauthorized access or unusual activity.

Hi! I’m here to help you understand CVE-2026-53580. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70