CVE-2026-53580 in Trilium
Summary
by MITRE • 08/27/2026
Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the automatic image-download feature accepts file:// URLs in a note's img tags and reads the referenced local file with no path validation, allowing any authenticated user to disclose arbitrary files readable by the Trilium process. When a text note is saved, Trilium scans its HTML for image sources and downloads each external one; because the HTML sanitizer keeps file as an allowed scheme, a source such as file:///etc/passwd is passed straight to a filesystem read and its contents are stored as a note attachment the user can then retrieve. Pointing the same primitive at an unbounded source such as /dev/zero causes uncontrolled memory allocation that crashes the server process. The feature is enabled by default and is reachable through the web UI, the ETAPI, the web clipper, and note imports, requiring only an authenticated session or an ETAPI token. This issue is fixed in version 0.104.0
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified in Trilium Notes prior to version 0.104.0 represents a critical server-side information disclosure and denial of service flaw rooted in the application's automatic image-download feature. As an open-source hierarchical note-taking platform, Trilium allows users to embed images within notes via HTML img tags. The system is designed to automatically fetch external resources referenced by these tags when a text note is saved or imported. However, this mechanism lacks sufficient validation for Uniform Resource Identifiers (URIs), specifically failing to restrict the protocol scheme to safe protocols such as HTTP and HTTPS. This architectural oversight permits the inclusion of file:// URLs within image sources, which are then processed directly by the backend without path traversal checks or scheme filtering beyond a basic whitelist that incorrectly includes the file scheme.
From a technical perspective, the core flaw lies in the HTML sanitizer configuration and the subsequent request handling logic. When an authenticated user saves a note containing an img tag with a src attribute pointing to a local file system resource, such as file:///etc/passwd on Linux systems or similar paths on Windows, the application does not reject this input. Instead, it passes the URI directly to the underlying HTTP client library responsible for downloading images. Because many standard HTTP libraries treat file:// URLs by reading from the local disk rather than making a network request, the server process reads the contents of arbitrary files that are accessible to the user account running the Trilium service. These file contents are then stored as note attachments within the database or file system associated with the application. This behavior effectively transforms the web application into an unauthorized file read primitive, allowing any authenticated user to exfiltrate sensitive configuration files, environment variables, source code, or other private data residing on the server's local storage.
The operational impact of this vulnerability is severe due to its direct correlation with confidentiality and availability requirements in security frameworks. In terms of information disclosure, an attacker can retrieve arbitrary files readable by the Trilium process account. This could lead to the exposure of database credentials stored in configuration files, internal network topology details found in system logs or host files, or proprietary code if source repositories are accessible via local paths. Furthermore, the vulnerability extends beyond simple data theft into denial of service conditions. By targeting unbounded sources such as /dev/zero on Unix-like systems, an attacker can trigger a continuous stream of null bytes being read and processed by the server. This results in uncontrolled memory allocation or CPU exhaustion as the application attempts to process the infinite input stream, ultimately causing the Trilium server process to crash or become unresponsive. This dual nature makes it both a data leak vector and an availability threat.
The attack surface for this vulnerability is broad because the feature is enabled by default and accessible through multiple entry points within the ecosystem. It can be exploited via the standard web user interface, the ETAPI (Trilium's REST API), the browser-based web clipper extension, or during note import operations. The requirement for authentication limits the scope to users who have valid credentials or an active session, but given that many deployments may use default configurations or weak passwords, this barrier is often surmountable. Additionally, if cross-site scripting vulnerabilities exist elsewhere in the application, a lower-privileged attacker could potentially trigger this behavior through stored XSS payloads without needing direct authentication for every action, although the primary vector remains authenticated access to note creation and editing functions.
To mitigate this risk, organizations running Trilium Notes must immediately upgrade to version 0.104.0 or later, where the developers have addressed the improper validation of URI schemes in the image download feature. For deployments that cannot be upgraded instantly due to compatibility constraints with other plugins or customizations, temporary mitigations should focus on restricting network egress and local file access at the infrastructure level. Running the Trilium service under a restricted user account with minimal permissions can limit the scope of files an attacker might read if they manage to exploit this flaw. Additionally, implementing strict input validation rules in reverse proxies or web application firewalls that block requests containing file:// schemes targeting internal resources may provide partial protection. However, these are compensatory controls and do not replace the need for a software patch. The vulnerability aligns with CWE-20 Improper Input Validation regarding URI scheme handling and CWE-434 Unrestricted Upload of File with Dangerous Type if considered in the context of storing downloaded content, while its exploitation path relates to ATT&CK technique T1567 Data Staged or Exfiltration Over Non-C2 Protocol when used for data theft.