TriliumNext vulnerabilities
We track 8 vulnerabilities in TriliumNext products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on August 27, 2026.
Latest TriliumNext vulnerabilities
- 7.5 High severity
Trilium: Exposure of Sensitive Information to an Unauthorized Actor
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public share-search endpoint does not enforce the per-note shareCredentials and shareHiddenFromTree controls, allowing an unauthenticated visitor to re
- 8.1 High severity
Trilium: External Control of File Name or Path
Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the automatic image-download feature accepts file:// URLs in a note's img tags and reads the referenced local file with no path validation, allowing any authenticated
- 8.8 High severity
Trilium: Improper Control of Generation of Code
Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the default-on "Safe import" filter fails to neutralize the shareTemplate relation because that relation is not marked as dangerous, allowing an attacker-supplied imp
- 8.3 High severity
Trilium: Improper Neutralization of Input During Web Page Generation
Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the #iconClass label value is returned raw by getNoteIcon() and inserted without HTML attribute encoding into class at
- 9.3 Critical severity
Trilium: Improper Limitation of a Pathname to a Restricted Directory
Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.102.2, a malicious ZIP archive imported with safe import enabled achieves RCE via #docName path traversal and XSS by combinin
- 8.6 High severity
Trilium: Improper Access Control
Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. In versions 0.102.1 and prior, the Clipper API in Trilium Desktop (v0.101.3) allows full authentication bypass when running in an Electr
- 7.4 High severity
Trilium: Observable Timing Discrepancy
Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases. Prior to 0.101.0, a critical timing attack vulnerability in Trilium's sync authentication endpoint allows unauthenticate
- 7.5 High severity
Trilium: Improper Restriction of Excessive Authentication Attempts
Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases. In versions below 0.97.0, a brute-force protection bypass in the initial sync seed retrieval endpoint allows unauthentic