Trilium.

Trilium unauthenticated share-search discloses password-protected and hidden shared notes

• Trilium
• Information disclosure
• Broken access control

Trilium arbitrary file read and denial of service via file:// URLs in the automatic image-download feature

• Trilium
• Path traversal
• Denial of service

Trilium: Note Import to RCE via Book Note

• Trilium
• Cross-site scripting (XSS)
• Code injection

Trilium: Note Import to RCE via Mind Elixir dangerouslySetInnerHtml

• Trilium
• Cross-site scripting (XSS)
• Code injection

Trilium: Malicious import with GeoMap marker title XSS leads to RCE on the desktop client

• Trilium
• Cross-site scripting (XSS)
• Code injection

Trilium: RCE via `shareTemplate` relation missing `isDangerous` flag — Safe import bypass leading to EJS SSTI (Incomplete Fix of CVE-2026-45668)

• Trilium
• Code injection

Trilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop app

• Trilium
• Cross-site scripting (XSS)
• CWE-693

Trilium Notes : Note Import to RCE via #docName Path Traversal (Safe Import Enabled)

• Trilium
• Path traversal
• Cross-site scripting (XSS)

Trilium Notes: Stored XSS Leads to Unauthorized Remote Code Execution (RCE) via Unsanitized SVG Attachments

• Trilium
• Cross-site scripting (XSS)
• Code injection

Trilium Notes: Authentication Bypass in Clipper API for Electron (Desktop) Builds

• Trilium
• Broken access control
• Authentication bypass

Trilium Notes: macOS TCC Bypass via Prompt Spoofing

• Trilium
• Authentication bypass
• CWE-451

Trilium Notes has Local File Inclusion via upload modified file API endpoint

• Trilium
• Path traversal

Trilium Notes has a Timing Attack Vulnerability in /api/login/sync

• Trilium
• CWE-208

Trilium Notes is Vulnerable to Brute-force Protection Bypass via Initial Sync Seed Retrieval

• Trilium
• Authentication bypass