CVE-2026-50553

Note Mark, an open-source self-hosted note-taking application, improperly validates book and note slugs prior to version 0.19.5 because its validation regex is tested unanchored, so any slug merely containing an allowed substring — including path-traversal sequences such as ../../ — is accepted and stored verbatim. When an administrator runs the 'note-mark migrate export' or 'note-mark migrate export-v1' CLI commands, these unsanitized slugs are joined directly into the output paths, so note files can be created outside the intended export directory. An attacker with low-privilege access to a Note Mark instance can plant or rename notes with malicious slugs and, when a privileged user later performs an export, achieve arbitrary directory creation and file write — commonly as root in default Docker or bare-metal admin usage — which could allow overwriting or planting files for further impact. Operators running any Note Mark version before 0.19.5 who perform exports are affected. There is no known exploitation in the wild, no public proof-of-concept, and EPSS currently estimates only a 0.4% probability of exploitation within 30 days.

What to do: Upgrade Note Mark to version 0.19.5 or later. Until upgraded, avoid running export commands as root (use a dedicated low-privilege user), review book and note slugs for '../' or path characters before running migrate export or export-v1, and check for unexpected files or directories created outside past export directories.