Read the docs
TI-2026-37275 Aliases CVE-2026-50553GHSA-rqrh-8wpv-x7hh

Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)

Priority HIGH 72CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and note slug values with the OpenAPI/huma tag pattern:"[a-z0-9-]+". huma compiles this with regexp.MustCompile(s.Pattern) and tests it with patternRe.MatchString(str), an UNANCHORED match. Because the pattern is not anchored (^...$), any string that merely CONTAINS one [a-z0-9-] substring passes validation. A slug such as ../../../../../../tmp/escape is accepted and stored verbatim. The data-export CLI commands (note-mark migrate export and note-mark migrate export-v1) join these unsanitized slugs straight into the output path with path.Join / filepath.Join, then os.MkdirAll the directory and os.Create the note file. path.Join resolves the ../ segments, so the note content file is written OUTSIDE the configured export directory. The export process commonly runs as root (default in Docker / bare-metal admin usage), so this is a root-privilege arbitrary directory create + file write. This issue has been patched in version 0.19.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00459 39th percentileScored 2026-11-07
Fix Fixed note-mark (enchant97): 0.19.5github.com/enchant97/note-mark/backend (Go): 0.0.0-20260601210719-67b7de04308a

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
enchant97note-markbefore 0.19.50.19.5Patch availableCNA
—github.com/enchant97/note-mark/backend (Go)before 0.0.0-20260601210719-67b7de04308a0.0.0-20260601210719-67b7de04308aPatch availableGHSA-rqrh-8wpv-x7hh
  • note-mark Vendorenchant97 Affected before 0.19.5 Fixed in 0.19.5 Patch available CNA
  • github.com/enchant97/note-mark/backend (Go) Vendor— Affected before 0.0.0-20260601210719-67b7de04308a Fixed in 0.0.0-20260601210719-67b7de04308a Patch available GHSA-rqrh-8wpv-x7hh

Remediation

  • Fix · CNA note-mark (enchant97) Fixed in 0.19.5
  • Fix · GHSA-rqrh-8wpv-x7hh github.com/enchant97/note-mark/backend (Go) Fixed in 0.0.0-20260601210719-67b7de04308a Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-50553
  2. 2026-10-03 Alias added: GHSA-rqrh-8wpv-x7hh

References

Other 4

  • TI-2026-32452 Note Mark: JWT Secret Weakness allows Full Account Takeover via token forgery CVSS 3.1CRITICAL 10.0
  • TI-2026-30126 Note Mark: OIDC-registered users authenticated by submitting password "null" CVSS 3.1CRITICAL 9.4
  • TI-2026-29056 Note Mark has Stored XSS via Unrestricted Asset Upload CVSS 3.1HIGH 8.7
  • TI-2026-32451 Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leading to Remote Code Execution CVSS 4.0HIGH 8.6
  • TI-2026-37276 Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark CVSS 3.1MEDIUM 5.3
  • TI-2026-30127 Note Mark: Unauthenticated read of notes and assets in soft-deleted public books CVSS 3.1MEDIUM 5.3
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences