Trilium Notes CVE-2026-53580

Exploitation requires a valid authenticated Trilium session or a valid ETAPI token - no unauthenticated or anonymous access path exists. The automatic image-download feature is enabled by default and requires no non-default configuration to be active. The attacker must be able to save or import a note containing an img tag with a file:// src URL, achievable via the web UI editor, ETAPI note creation or update endpoints, the web clipper extension, or the note import function. The targeted file must be readable by the OS user account under which the Trilium server process runs. No Trilium administrative or elevated role is required beyond a standard user session. Exploitation is bounded to files accessible to the server process and does not provide write access or code execution; the availability (DoS) vector requires no specific file target, only an unbounded source such as /dev/zero.

The CVSS 8.1 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) is well-supported by the description: the attack requires only a valid authenticated session or ETAPI token, imposes no additional complexity, and produces a dual high-severity impact - confidentiality loss via arbitrary file read and availability loss via server crash. EPSS data is absent from the provided intelligence, so exploitation probability cannot be quantified numerically; however, the attack path is mechanically simple, requires no exploit tooling, and the feature is enabled by default across all pre-0.104.0 installations. No CISA KEV listing is present and no public exploit code has been identified, moderating urgency compared to an actively exploited scenario. Practical risk is highest for multi-user Trilium instances where not all authenticated users are fully trusted, and for deployments where the Trilium process runs with broad filesystem permissions that expose sensitive files such as private keys, credential stores, or database configuration files. The availability vector is particularly disruptive because a single crafted note can crash the server for all users with no privileged access. The four distinct attack surfaces (web UI, ETAPI, web clipper, import) meaningfully increase the likelihood of exploitation in environments that expose any of these endpoints.

An authenticated Trilium user creates a note containing an img tag with src set to file:///etc/ssh/ssh_host_rsa_key or another file readable by the server process. Trilium's image-download service reads the file and stores its contents as a base64-encoded note attachment; the attacker retrieves this attachment through the standard attachment download API, exfiltrating the file without any elevated privileges. In a second scenario, the attacker sets src to file:///dev/zero, causing the server to allocate memory unboundedly until the process crashes, denying service to all Trilium users.