CVE-2026-77438 – Trilium
“Trusted note features can expose server files, crash the application, and reveal protected shared content.”
Trilium fixes two High-severity vulnerabilities. CVE-2026-53580 allows an authenticated user to abuse automatic image downloading with file:// URLs to read arbitrary files accessible to the Trilium process. The same flaw can also exhaust memory and crash the server. The CVSS score is 8.1, which is High severity.
CVE-2026-77438 allows unauthenticated users to bypass protection on shared notes through the public share-search endpoint, exposing titles, paths, and potentially complete note content. The CVSS score is 7.5, which is High severity. Public proof-of-concept material is available for both vulnerabilities. Trilium 0.104.0 contains the fixes.
Key Details
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-200