rootpwn

critical · CVSS v3 9.6

CVE-2026-54053

Many Notes, a Markdown note‑taking web application, had a flaw in its ZIP vault import that allowed authenticated users to include path‑trav

Overview

Many Notes, a Markdown note‑taking web application, had a flaw in its ZIP vault import that allowed authenticated users to include path‑traversal segments in archive filenames. This enabled writing files outside the importing user’s vault, overwriting other users’ files and injecting malicious SVG that triggers stored XSS when the victim opens the vault. The issue is fixed in version 0.16.0.

Description

Many Notes is a Markdown note-taking web application designed for simplicity. Prior to 0.16.0, the ZIP vault import implemented in app/Actions/ProcessImportedVault.php accepts archive filenames containing parent-directory traversal segments. An authenticated user can write arbitrary files outside the importing user's vault and into other users' vaults, including overwriting existing files. Disguised SVG content can be placed in another user's vault and execute stored cross-site scripting when the victim opens that vault. This issue is fixed in version 0.16.0.

Impact

Confidentiality is compromised as attackers can read other users’ vaults. Integrity is affected because attackers can overwrite existing files, potentially corrupting data. Availability is at risk if critical files are replaced or corrupted. The primary impact is on authenticated users and administrators who rely on the integrity of stored notes.

Remediation

Upgrade to Many Notes 0.16.0 or later. If an upgrade is not immediately possible, restrict ZIP import to reject filenames containing '..' or absolute paths, enforce a whitelist of allowed directories, and validate that extracted files reside within the user’s vault. Additionally, sanitize or strip SVG content before storing it to prevent XSS. Monitor logs for anomalous file creation or overwrite events.

Risk context

The vulnerability is rated critical with a CVSS v3 score of 9.6, indicating a high likelihood of exploitation by authenticated users. Immediate attention is warranted to prevent potential data loss and cross‑site scripting attacks.

Affected products

  • Many Notes

Scores

Severity
critical
CVSS v2
8.5
CVSS v3
9.6
CVSS v4
—
EPSS
—

path-traversal zip-import xss critical many-notes file-overwrite authenticated-attack

← All CVEs

Related CVEs

critical

CVE-2026-62874

CVE‑2026‑62874 exposes a flaw in Azure Billing where data authenticity is not properly verified. An attacker can exploit this to gain elevated privileges on the network, potentially accessing or modifying billing and subscription data. The vulnerability is critical with a CVSS v3 score of 10.0.

View analysis

critical

CVE-2026-69843

CVE‑2026‑69843 is a critical authentication bypass in Microsoft Fabric that lets an attacker spoof credentials and gain elevated privileges across the network. The flaw allows unauthorized users to impersonate legitimate accounts, potentially accessing sensitive data and services. It is a high‑risk vulnerability that requires immediate attention from defenders.

View analysis

critical

CVE-2026-85878

CVE-2026-85878 exposes an improper authorization flaw in Azure Database for PostgreSQL that lets an authenticated user gain elevated privileges across the network. The vulnerability can be exploited by users who already have access to the database, enabling them to perform actions beyond their intended scope. It is critical because it bypasses normal role boundaries and can lead to widespread compromise of data and services.

View analysis

critical

CVE-2026-93453

SOGo versions before 5.12.11 can construct password-reset links using a client-supplied Origin header as the link authority. This can cause valid recovery tokens to be delivered in links pointing to attacker-controlled domains. It matters because it can enable account takeover for users who rely on SOGo password recovery.

View analysis