# Trilium.

Every CVE that names Trilium among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Trilium unauthenticated share-search discloses password-protected and hidden shared notes](https://agentprime.io/advisories/CVE-2026-77438.md)
  `CVE-2026-77438` · CVE record: TriliumNext Trilium · CVSS 7.5 High · Not analysed yet · Published 27 Aug 2026 · Tags: Information disclosure, Broken access control
- [Trilium arbitrary file read and denial of service via file:// URLs in the automatic image-download feature](https://agentprime.io/advisories/CVE-2026-53580.md)
  `CVE-2026-53580` · CVE record: TriliumNext Trilium · CVSS 8.1 High · Not analysed yet · Published 27 Aug 2026 · Tags: Path traversal, Denial of service, Information disclosure
- [Trilium: Note Import to RCE via Book Note](https://agentprime.io/advisories/CVE-2026-53579.md)
  `CVE-2026-53579` · CVE record: TriliumNext Trilium · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Trilium: Note Import to RCE via Mind Elixir dangerouslySetInnerHtml](https://agentprime.io/advisories/CVE-2026-53578.md)
  `CVE-2026-53578` · CVE record: TriliumNext Trilium · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Trilium: Malicious import with GeoMap marker title XSS leads to RCE on the desktop client](https://agentprime.io/advisories/CVE-2026-48996.md)
  `CVE-2026-48996` · CVE record: TriliumNext Trilium · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Trilium: RCE via \`shareTemplate\` relation missing \`isDangerous\` flag — Safe import bypass leading to EJS SSTI (Incomplete Fix of CVE-2026-45668)](https://agentprime.io/advisories/CVE-2026-47727.md)
  `CVE-2026-47727` · CVE record: TriliumNext Trilium · CVSS 8.6 High · Not analysed yet · Published 27 Aug 2026 · Tags: Code injection
- [Trilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop app](https://agentprime.io/advisories/CVE-2026-45733.md)
  `CVE-2026-45733` · CVE record: TriliumNext Trilium · CVSS 8.3 High · Not analysed yet · Published 18 Aug 2026 · Tags: Cross-site scripting (XSS), CWE-693
- [Trilium Notes : Note Import to RCE via #docName Path Traversal (Safe Import Enabled)](https://agentprime.io/advisories/CVE-2026-45668.md)
  `CVE-2026-45668` · CVE record: TriliumNext Trilium · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 May 2026 · Tags: Path traversal, Cross-site scripting (XSS)
- [Trilium Notes: Stored XSS Leads to Unauthorized Remote Code Execution (RCE) via Unsanitized SVG Attachments](https://agentprime.io/advisories/CVE-2026-39311.md)
  `CVE-2026-39311` · CVE record: TriliumNext Trilium · CVSS 6.8 Medium · Not analysed yet · Published 20 May 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Trilium Notes: Authentication Bypass in Clipper API for Electron (Desktop) Builds](https://agentprime.io/advisories/CVE-2026-39310.md)
  `CVE-2026-39310` · CVE record: TriliumNext Trilium · CVSS 8.6 High · Not analysed yet · Published 20 May 2026 · Tags: Broken access control, Authentication bypass
- [Trilium Notes: macOS TCC Bypass via Prompt Spoofing](https://agentprime.io/advisories/CVE-2026-39309.md)
  `CVE-2026-39309` · CVE record: TriliumNext Trilium · CVSS 5.5 Medium · Not analysed yet · Published 19 May 2026 · Tags: Authentication bypass, CWE-451
- [Trilium Notes has Local File Inclusion via upload modified file API endpoint](https://agentprime.io/advisories/CVE-2026-35593.md)
  `CVE-2026-35593` · CVE record: TriliumNext Trilium · CVSS 6.8 Medium · Not analysed yet · Published 19 May 2026 · Tags: Path traversal
- [Trilium Notes has a Timing Attack Vulnerability in /api/login/sync](https://agentprime.io/advisories/CVE-2025-68621.md)
  `CVE-2025-68621` · CVE record: TriliumNext Trilium · CVSS 7.4 High · Not analysed yet · Published 6 Feb 2026 · Tags: CWE-208
- [Trilium Notes is Vulnerable to Brute-force Protection Bypass via Initial Sync Seed Retrieval](https://agentprime.io/advisories/CVE-2025-53544.md)
  `CVE-2025-53544` · CVE record: TriliumNext Trilium · CVSS 7.5 High · Not analysed yet · Published 5 Aug 2025 · Tags: Authentication bypass

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=trilium>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/trilium/>. Everything for agents: <https://agentprime.io/llms.txt>.