CVE-2026-47727

Trilium (open-source hierarchical note-taking app) versions prior to 0.104.0 are vulnerable to remote code execution via a bypass of its default-on "Safe import" filter. The shareTemplate relation is omitted from the built-in list of dangerous attributes, so it is not disabled on import. An attac...