Is CVE-2026-44522 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44522 being exploited in the wild.

How severe is CVE-2026-44522?

High severity, with a CVSS score of 4, published 14 May 2026.

Which products and versions are affected?

Enchant97 Note Mark < 0.19.4, 0.13.0 to 0.19.3; github.com/enchant97/note-mark/backend (Go) < 0.0.0-20260501152243-db3f72bff780, SEMVER:introduced=0,fixed=0.0.0-20260501152243-db3f72bff780.

Is there a fix for CVE-2026-44522?

Yes. github.com/enchant97/note-mark/backend (Go): upgrade to 0.0.0-20260501152243-db3f72bff780 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44522 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-44522?

Check whether you run Enchant97 Note Mark or github.com/enchant97/note-mark/backend (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44522: enchant97 Note Mark path traversal in asset upload

Q: Which products and versions are affected?

Enchant97 Note Mark < 0.19.4, 0.13.0 to 0.19.3; github.com/enchant97/note-mark/backend (Go) < 0.0.0-20260501152243-db3f72bff780, SEMVER:introduced=0,fixed=0.0.0-20260501152243-db3f72bff780.

Q: Is there a fix for CVE-2026-44522?

Yes. github.com/enchant97/note-mark/backend (Go): upgrade to 0.0.0-20260501152243-db3f72bff780 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-44522 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-44522?

Check whether you run Enchant97 Note Mark or github.com/enchant97/note-mark/backend (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44522 · Severity: high · CVSS 4 · Published 2026-05-14

Note Mark is a self-hosted note-taking application. A vulnerability allows an authenticated user to upload a file with a specially crafted name that, when later exported by an administrator, can overwrite critical system files. This can lead to a complete takeover of the server by allowing the attacker to execute arbitrary commands with root privileges.

Technologies: Enchant97 Note Mark, github.com/enchant97/note-mark/backend (Go). Vendors: Enchant97, Go.

Quick answers

Is CVE-2026-44522 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44522 being exploited in the wild.
How severe is CVE-2026-44522?: High severity, with a CVSS score of 4, published 14 May 2026.
Which products and versions are affected?: Enchant97 Note Mark < 0.19.4, 0.13.0 to 0.19.3; github.com/enchant97/note-mark/backend (Go) < 0.0.0-20260501152243-db3f72bff780, SEMVER:introduced=0,fixed=0.0.0-20260501152243-db3f72bff780.
Is there a fix for CVE-2026-44522?: Yes. github.com/enchant97/note-mark/backend (Go): upgrade to 0.0.0-20260501152243-db3f72bff780 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44522 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-44522?: Check whether you run Enchant97 Note Mark or github.com/enchant97/note-mark/backend (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/enchant97/note-mark/backend (Go): upgrade to 0.0.0-20260501152243-db3f72bff780 or later
```
go get github.com/enchant97/note-mark/backend@v0.0.0-20260501152243-db3f72bff780
```

Technical details

The Note Mark application fails to sanitize the 'X-Name' HTTP header during asset uploads via 'POST /api/notes/{noteID}/assets'. This unsanitized string is stored in the database and later used by the CLI migration/export commands ('note-mark migrate export') in 'filepath.Join()' and 'os.Create()' calls. Because 'filepath.Join' resolves '..' sequences, an attacker can provide a path traversal string (e.g., '../../../../bin/bash') to overwrite arbitrary files on the host filesystem. Since the export process often runs with root privileges, this allows for Remote Code Execution (RCE) by overwriting system binaries or configuration files. The vulnerability is patched in version 0.19.4.

Affected products

enchant97 Note Mark < 0.19.4

Identifiers

CVE-2026-44522
GHSA-g49p-4qxj-88v3
GO-2026-5389

Timeline

2026-05-01: patched: Fix committed to repository
2026-05-07: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.