Many Notes: Path Traversal via ZIP import allows arbitrary file write and stored XSS in other users' vaults
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Many Notes is a Markdown note-taking web application designed for simplicity. Prior to 0.16.0, the ZIP vault import implemented in app/Actions/ProcessImportedVault.php accepts archive filenames containing parent-directory traversal segments. An authenticated user can write arbitrary files outside the importing user's vault and into other users' vaults, including overwriting existing files. Disguised SVG content can be placed in another user's vault and execute stored cross-site scripting when the victim opens that vault. This issue is fixed in version 0.16.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA many-notes (brufdev) Fixed in 0.16.0
Timeline
- 2026-10-02 Threatist record created from CVE-2026-54053
References
More brufdev vulnerabilities
- TI-2025-35019 Many Notes 0.10.1 is vulnerable to Cross Site Scripting (XSS), which allows malicious… CVSS 3.1MEDIUM 6.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences