CVE-2026-53580

Trilium Notes, an open-source hierarchical note-taking application, in versions before 0.104.0 allows arbitrary local file disclosure and a denial-of-service through its automatic image-download feature. When a text note is saved, Trilium scans the HTML for image sources and downloads each external one; because the HTML sanitizer keeps file as an allowed scheme, an authenticated user can embed a source such as file:///etc/passwd, which is passed directly to a filesystem read with no path validation and stored as a note attachment the user can then retrieve. An attacker holding any authenticated session or ETAPI token gains read access to arbitrary files readable by the Trilium process, and can crash the server process by pointing the same primitive at an unbounded source such as /dev/zero, which drives uncontrolled memory allocation. All Trilium deployments running versions prior to 0.104.0 are affected; the feature is enabled by default and reachable through the web UI, the ETAPI, the web clipper, and note imports. No public proof-of-concept is known, the issue is not in CISA's KEV catalog, and EPSS currently assigns roughly a 0.3% probability of exploitation within 30 days, so no in-the-wild exploitation has been reported.

What to do: Upgrade all Trilium server deployments to version 0.104.0 or later. Until patched, restrict note-creation rights and ETAPI tokens to trusted users, minimize the local files readable by the Trilium process account, and audit existing note attachments for content pulled in via file:// image sources. Keep the instance off the public internet or behind a VPN where feasible, and consider disabling automatic image download if that option is available in your build.