What is the CVSS score of CVE-2026-50873?

CVE-2026-50873 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of flatnotes are affected by CVE-2026-50873?

Flatnotes v5.5.4 users face a critical risk of complete application compromise through remote code execution, with working exploit code already in public circulation.

How to fix or mitigate CVE-2026-50873?

Within 24 hours: Disable file upload functionality in flatnotes v5.5.4 or restrict uploads to plaintext-only formats; restrict network access to the application to essential users and trusted networks only. Within 7 days: Conduct forensic assessment of all flatnotes v5.5.4 deployments for evidence of exploitation; complete inventory of affected systems and begin evaluation of alternative note-taking platforms. Within 30 days: Migrate all users off flatnotes v5.5.4 to an alternative solution; if business continuity requires flatnotes retention, implement and validate web application firewall rules blocking HTML and SVG file uploads.

flatnotes CVE-2026-50873

EUVD-2026-36771 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-06-15 mitre

GHSA-wv29-ggqw-p97w

File Upload RCE N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Attachment upload typically requires an authenticated session in flatnotes, so PR:L rather than PR:N; HTML/SVG upload trivially yields full app-context compromise (C/I/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 13:24 vuln.today

CVSS changed

Jun 16, 2026 - 13:22 NVD

9.8 (CRITICAL)

CVE Published

Jun 15, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An arbitrary file upload vulnerability in the attachment handling component of flatnotes v5.5.4 allows attackers to execute arbitrary code via uploading a crafted HTML or SVG file.

AnalysisAI

Arbitrary code execution in flatnotes v5.5.4 is achievable by uploading crafted HTML or SVG files through the attachment handling component, enabling remote attackers to run code in the context of the application. The CVSS 9.8 rating reflects network-reachable, unauthenticated exploitation with full impact on confidentiality, integrity, and availability. Publicly available exploit code exists via a referenced GitHub gist, though there is no public exploit identified as actively exploited in the CISA KEV catalog at time of analysis.

Technical ContextAI

flatnotes is a self-hosted, database-less note-taking web application that stores notes as flat Markdown files and supports file attachments. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): the attachment handler accepts HTML and SVG content without sufficient validation of MIME type, extension, or embedded script content. Because HTML and SVG are both script-capable formats in a browser context, serving them back from the application's origin allows attacker-controlled JavaScript to run in the user's session, and depending on how attachments are stored and rendered, the upload primitive can be chained into broader code execution. The provided CPE string is a placeholder ('n/a:n/a'), so authoritative vendor CPE data is not available for automated matching.

RemediationAI

No vendor-released patch identified at time of analysis; defenders should monitor the flatnotes GitHub repository for a release later than 5.5.4 that addresses attachment validation and upgrade as soon as one is published. As compensating controls, place flatnotes behind an authenticating reverse proxy or VPN so the upload endpoint is not reachable by unauthenticated attackers (trade-off: blocks legitimate anonymous sharing if used), enforce a strict Content-Security-Policy and 'Content-Disposition: attachment' response header on the attachment-serving path to prevent inline rendering of HTML/SVG (trade-off: legitimate inline image previews for SVG break), and front the application with a WAF or proxy rule that rejects uploads whose content sniffs as HTML or SVG regardless of extension. The public POC at https://gist.github.com/pyuysig/ab0af5b10877fb906941e05a69b202a7 should be reviewed to inform detection rules.