Trilium CVE-2026-47727

Three sequential conditions must be satisfied: first, a Trilium user with import privileges must import an attacker-controlled export archive - this is the step the Safe Import filter is supposed to prevent, and the bypass occurs because shareTemplate lacks the isDangerous flag; second, the same user (or any user with access to the note) must publish the imported note by enabling public sharing on it; third, the attacker must be able to send an HTTP request to the Trilium instance's public share endpoint. Exploitation is blocked if public note sharing is disabled at the application level or if the share endpoint is not reachable from the attacker's network position. Instances that have never had any notes published publicly, or that operate entirely behind a firewall with no external HTTP access, cannot be exploited at step three even if steps one and two have already occurred. The key misleading condition for defenders is that the Safe Import option appears to promise safety, giving users a false sense of protection when importing untrusted archives.

The CVSS 4.0 score of 8.6 (High) with vector AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H accurately reflects the attack profile. The UI:A (active user interaction) metric is the principal limiting factor: the attacker cannot directly reach the vulnerable code path without first convincing a legitimate Trilium user to import a malicious archive and separately publish the affected note - two distinct user actions that require social engineering. Once these conditions are met, however, the subsequent trigger is fully unauthenticated and requires only a single HTTP request to the public share URL, meaning the exploitation window is permanent until the note is unpublished or the instance is patched. No EPSS score was available in the provided intelligence data. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, and no public proof-of-concept code has been identified at time of analysis. The confidentiality, integrity, and availability impact metrics are all rated High, reflecting that successful exploitation yields full Node.js server-side RCE with unrestricted filesystem and network access. Trilium instances exposed to the internet with public note sharing enabled face the highest real-world risk; private, air-gapped, or non-sharing-enabled deployments are substantially less exposed due to the social engineering prerequisite.

An attacker crafts a Trilium export archive containing a note that holds a shareTemplate relation pointing to a companion EJS code note with a reverse-shell payload (e.g., using Node.js child_process.exec). The archive is distributed through a Trilium community forum or shared workspace as a legitimate-looking template collection. A Trilium user imports it using the built-in Safe Import option - trusting the filter to block dangerous content - and later publishes the note to share it with colleagues. The attacker then sends a single unauthenticated GET request to the public share URL, which causes the Trilium server's EJS renderer to compile and execute the payload, granting the attacker an interactive shell on the server with the full privileges of the Node.js process.