CVE-2026-44522
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
In Note Mark from 0.13.0 to before 0.19.4, the asset filename provided via the X-Name header by an authenticated user is stored without validation, allowing directory traversal sequences. During CLI export, the stored name is passed to `filepath.Join()` and `os.Create()`, enabling file writes to arbitrary locations on the filesystem.
Risk Assessment
An attacker could overwrite or create files outside the intended export directory, potentially leading to data corruption or code execution if critical files are overwritten.
Recommendation
Upgrade Note Mark to version 0.19.4 or later. Until then, restrict asset uploads by users and perform exports in a controlled environment.
Other vulnerabilities in Note Mark
See all- CVE-2026-44523Critical
The Note Mark application prior to version 0.19.4 does not enforce minimum length or entropy for the JWT_SECRET configuration value. It allows any base64-decodable secret, including secrets as short as 1 byte.
- CVE-2026-50553High
Note Mark prior to version 0.19.5 improperly validates slug values because the OpenAPI/huma pattern is not anchored, allowing paths with ../ segments to be accepted. Data export commands use these slugs to create files outside the export directory, potentially leading to file writes with root privileges.
- CVE-2026-50554Medium
Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID}/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped() (bypassing GORM's soft-delete scope) but keeps the read-authorization clause as "owner_id = ? OR is_public = ?". As a result, any unauthenticated caller can enumerate the metadata of soft-deleted ("trashed") notes belonging to any public book — notes the owner explicitly deleted and expected to be removed from public view.
- CVE-2026-41572Medium
Note Mark is an open-source note-taking application. Prior to version 0.19.3, after a note-mark owner soft-deletes a public book, its notes and uploaded assets stay readable at /api/notes/{id}, /api/notes/{id}/content, the slug URL, and the asset endpoints. Unauthenticated callers who hold the note ID or the slug path retain access. GORM's soft-delete scope does not reach the raw "JOIN books ..." clauses used by the note and asset queries.
- CVE-2026-40265Medium
In Note Mark versions 0.19.1 and prior, the /api/notes/{noteID}/assets/{assetID} endpoint lacks authentication middleware and the backend query does not verify ownership or book visibility. An unauthenticated user knowing valid note and asset IDs can retrieve full contents of private note assets.
- CVE-2026-40263Low
In Note Mark versions 0.19.1 and prior, the login endpoint performs bcrypt password verification only for existing usernames, returning immediately for nonexistent ones. This timing discrepancy allows unauthenticated attackers to enumerate valid usernames. The issue is fixed in version 0.19.2.
Original NVD description (English source)
Note Mark is an open-source note-taking application. From 0.13.0 to before 0.19.4, the Note Mark application allows authenticated users to upload assets to notes via POST /api/notes/{noteID}/assets, where the asset filename is provided through the X-Name HTTP request header. This value is stored directly in the database without any sanitization or validation - no path separator filtering, no directory traversal sequence rejection, and no use of filepath.Base() to strip directory components. The unsanitized name is persisted as-is in the note_assets table (Name column, varchar(80)). When an administrator subsequently runs the data export CLI commands (note-mark migrate export-v1 or note-mark migrate export), the stored asset name is passed directly into filepath.Join() and path.Join() calls as part of the output file path argument to os.Create(). Since Go's filepath.Join() resolves ../ sequences during path normalization, an attacker-controlled asset name containing directory traversal sequences causes the export process to write files to arbitrary locations on the filesystem, completely outside the intended export directory. This vulnerability is fixed in 0.19.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS