---
id: CVE-2026-54053
title: Many Notes is a Markdown note-taking web application designed for simplicity
summary: >-
  Many Notes is a Markdown note-taking web application designed for simplicity.
  Prior to 0.16.0, the ZIP vault import implemented in
  app/Actions/ProcessImportedVault.php accepts archive filenames containing
  parent-directory traversal segme…
severity: critical
cvss: 9.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N'
cwe:
  - CWE-22
vendor: brufdev
product: many-notes
affected:
  - many-notes < 0.16.0
published: '2026-09-17'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T21:17:15.823'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54053'
references:
  - url: >-
      https://github.com/brufdev/many-notes/commit/1b3288fa9671002e72e38b7fcd5d226673ba0cae
    label: security-advisories@github.com
  - url: 'https://github.com/brufdev/many-notes/releases/tag/v0.16.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/brufdev/many-notes/security/advisories/GHSA-wg8j-9c2g-xh6r
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-24T20:38:10.394392Z'
epss: 0.01052
epssPercentile: 0.62799
ingestedAt: '2026-09-17T17:23:30.696Z'
---

## Overview

Many Notes is a Markdown note-taking web application designed for simplicity. Prior to 0.16.0, the ZIP vault import implemented in app/Actions/ProcessImportedVault.php accepts archive filenames containing parent-directory traversal segments. An authenticated user can write arbitrary files outside the importing user's vault and into other users' vaults, including overwriting existing files. Disguised SVG content can be placed in another user's vault and execute stored cross-site scripting when the victim opens that vault. This issue is fixed in version 0.16.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.