Many Notes CVE-2026-54053

Requires an authenticated account on the Many Notes instance (PR:L) and use of the ZIP vault import feature in app/Actions/ProcessImportedVault.php, which in versions prior to 0.16.0 fails to reject archive entry filenames containing parent-directory ('..') traversal segments. The arbitrary cross-user file write/overwrite needs no victim interaction. The stored-XSS confidentiality impact is additionally LIMITED by requiring the victim user to subsequently open the vault into which the disguised SVG was planted, and by the browser rendering that SVG. Multi-user deployments are the realistic target, since the value of the flaw is writing into vaults owned by other users.

This is a genuinely high-severity flaw, though the vendor CVSS 9.6 is somewhat inflated. The vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) reflects a low-complexity, low-privilege (any authenticated user) attack with a scope change because writes land in OTHER users' vaults. The core, unconditional primitive is cross-user arbitrary file write/overwrite via ZIP path traversal - that solidly justifies I:H and S:C. The C:H (full confidentiality) rating is more aggressive: confidentiality loss occurs only through the stored-SVG XSS, which requires the victim to open the poisoned vault (effectively user interaction the vendor did not price into UI:N), so C:H should really be C:L and gated. No EPSS score, KEV listing, or public POC is provided in the input, so exploitation status is 'no public exploit identified at time of analysis' - the 9.6 is a severity signal, not evidence of active exploitation. The confirming code diff (rejecting entries whose path pieces contain '..') makes the vulnerability mechanism unambiguous, but the tiny real-world footprint of this self-hosted app keeps aggregate risk moderate despite the high score.

An authenticated Many Notes user crafts a ZIP archive whose entry filenames contain '../' traversal segments pointing into another user's vault directory, then uses the vault import feature. The malicious ZIP writes or overwrites files - including a disguised SVG containing script - into the victim's vault, and the payload fires as stored XSS in the victim's session when they next open that vault. No public exploit code is identified in the provided data, but the fixing commit clearly reveals the traversal mechanism.