---
id: CVE-2026-45668
title: >-
  Trilium Notes is a cross-platform, hierarchical note taking application
  focused on building large personal knowledge bases
summary: >-
  Trilium Notes is a cross-platform, hierarchical note taking application
  focused on building large personal knowledge bases. Prior to 0.102.2, a
  malicious ZIP archive imported with safe import enabled achieves RCE via
  #docName path traver…
severity: none
cwe:
  - CWE-22
  - CWE-79
published: '2026-05-29'
updated: '2026-07-22'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-45668'
references:
  - url: >-
      https://github.com/TriliumNext/Trilium/security/advisories/GHSA-9jjc-cccq-f6rh
    label: security-advisories@github.com
  - url: >-
      https://github.com/TriliumNext/Trilium/security/advisories/GHSA-9jjc-cccq-f6rh
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00207
epssPercentile: 0.09599
ingestedAt: '2026-07-22T20:06:05.167Z'
---

## Overview

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.102.2, a malicious ZIP archive imported with safe import enabled achieves RCE via #docName path traversal and XSS by combining a payload note (type: code, mime: text/plain) containing raw HTML/JS and a trigger note (type: doc or type: launcher) with a #docName label that uses ../ path traversal to point at the payload note's API endpoint. The desktop client Electron renderer runs with nodeIntegration enabled, so an RCE is triggered once the payload is executed. This vulnerability is fixed in 0.102.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.