CVE-2026-50553
Received Received - Intake

Path Traversal in Note Mark Application

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: GitHub, Inc.

Description
Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and note slug values with the OpenAPI/huma tag pattern:"[a-z0-9-]+". huma compiles this with regexp.MustCompile(s.Pattern) and tests it with patternRe.MatchString(str), an UNANCHORED match. Because the pattern is not anchored (^...$), any string that merely CONTAINS one [a-z0-9-] substring passes validation. A slug such as ../../../../../../tmp/escape is accepted and stored verbatim. The data-export CLI commands (note-mark migrate export and note-mark migrate export-v1) join these unsanitized slugs straight into the output path with path.Join / filepath.Join, then os.MkdirAll the directory and os.Create the note file. path.Join resolves the ../ segments, so the note content file is written OUTSIDE the configured export directory. The export process commonly runs as root (default in Docker / bare-metal admin usage), so this is a root-privilege arbitrary directory create + file write. This issue has been patched in version 0.19.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-50553
EUVD
EUVD-2026-71618

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
note_mark note_mark to 0.19.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Note Mark (before version 0.19.5) allows path traversal due to improper validation of note slugs. The application uses an unanchored regex pattern to validate slugs, so strings containing valid substrings like ../../../../../../tmp/escape are accepted. During data export, these slugs are used to create files outside the intended directory, leading to arbitrary file creation with root privileges.

Detection Guidance

Check if Note Mark version is below 0.19.5 by running: note-mark version. Inspect export logs for note-mark migrate export or note-mark migrate export-v1 commands for unusual file paths or directory creation outside expected locations.

Impact Analysis

An attacker could exploit this to write files anywhere on the system where the export process has permissions, potentially overwriting critical files, installing malware, or gaining further access. Since exports often run as root, the impact includes full system compromise.

Compliance Impact

This vulnerability could lead to unauthorized file access or modification, violating data integrity and confidentiality requirements in GDPR and HIPAA. Unauthorized file writes may expose sensitive data or allow tampering with records, leading to compliance breaches and potential legal consequences.

Mitigation Strategies

Upgrade Note Mark to version 0.19.5 or later immediately. Avoid running export commands as root until patched. Review and remove any unauthorized files or directories created outside the export directory.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50553. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart