Skip to content
OpenAdvisories

Vendor

TriliumNext

14 known vulnerabilities.

Products

Trilium 14
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 7.5
    CVE-2026-77438

    Trilium unauthenticated share-search discloses password-protected and hidden shared notes

    Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public share-search endpoint does not enforce the per-note shareCredentials and shareHiddenFromTree controls, allowing an unauthenticated visitor to r…

    TriliumNext Trilium
  • High 8.1
    CVE-2026-53580

    Trilium arbitrary file read and denial of service via file:// URLs in the automatic image-download feature

    Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the automatic image-download feature accepts file:// URLs in a note's img tags and reads the referenced local file with no path validation, allowing any authenticate…

    TriliumNext Trilium
  • High 8.6
    CVE-2026-47727

    Trilium: RCE via `shareTemplate` relation missing `isDangerous` flag — Safe import bypass leading to EJS SSTI (Incomplete Fix of CVE-2026-45668)

    Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the default-on "Safe import" filter fails to neutralize the shareTemplate relation because that relation is not marked as dangerous, allowing an attacker-supplied im…

    TriliumNext Trilium
  • High 8.3
    CVE-2026-45733

    Trilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop app

    Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the #iconClass label value is returned raw by getNoteIcon() and inserted without HTML attribute encoding into class a…

    TriliumNext Trilium
  • High 8.6
    CVE-2026-39310

    Trilium Notes: Authentication Bypass in Clipper API for Electron (Desktop) Builds

    Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. In versions 0.102.1 and prior, the Clipper API in Trilium Desktop (v0.101.3) allows full authentication bypass when running in an Elect…

    TriliumNext Trilium
  • High 7.4
    CVE-2025-68621 Public exploit

    Trilium Notes has a Timing Attack Vulnerability in /api/login/sync

    Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases. Prior to 0.101.0, a critical timing attack vulnerability in Trilium's sync authentication endpoint allows unauthenticat…

    TriliumNext Trilium
  • High 7.5
    CVE-2025-53544

    Trilium Notes is Vulnerable to Brute-force Protection Bypass via Initial Sync Seed Retrieval

    Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases. In versions below 0.97.0, a brute-force protection bypass in the initial sync seed retrieval endpoint allows unauthenti…

    TriliumNext Trilium