CVE-2026-35593

🗓️ 19 May 2026 23:32:54Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 64 Views🌐 WEB

Authenticated users can read arbitrary server files via upload modified file in the attachment API; fixed in 0.102.2.

Reporter	Title	Published	Views	Family All 11
attackerkb	CVE-2026-35593	19 May 202623:32	–	attackerkb
Circl	CVE-2026-35593	20 May 202602:53	–	circl
CNNVD	Trilium Notes 路径遍历漏洞	20 May 202600:00	–	cnnvd
Cvelist	CVE-2026-35593 Trilium Notes has Local File Inclusion via upload modified file API endpoint	19 May 202623:32	–	cvelist
EUVD	EUVD-2026-31007	19 May 202623:32	–	euvd
Mend	CVE-2026-35593	19 May 202623:32	–	mend
NVD	CVE-2026-35593	20 May 202600:16	–	nvd
Positive Technologies	PT-2026-42024	19 May 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-35593: Improper Limitation of a Pathname to a Restricted Directory	20 May 202600:00	–	rapid7
RedhatCVE	CVE-2026-35593	5 Jun 202619:23	–	redhatcve

Vulners

Node

trilium_project triliumRange<0.102.2

[
  {
    "vendor": "TriliumNext",
    "product": "Trilium",
    "versions": [
      {
        "version": "< 0.102.2",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/TriliumNext/Trilium/releases/tag/v0.102.2
github	www.github.com/TriliumNext/Trilium/security/advisories/GHSA-hf4x-22rg-pjjp

Parameter	Position	Path	Description	CWE
filePath	request body	/api/attachments/{attachmentId}/upload-modified-file	Local File Inclusion via upload-modified-file: attacker-controlled filePath in request body causes server to replace attachment content with arbitrary file content.	CWE-22, CWE-73

24 Jul 2026 09:10Current

6.3Medium risk

Vulners AI Score6.3

CVSS 3.16.8

EPSS0.00734

SSVC