CVE-2026-44522: enchant97 Note Mark path traversal in asset upload

Executive brief

Note Mark is a self-hosted note-taking application. A vulnerability allows an authenticated user to upload a file with a specially crafted name that, when later exported by an administrator, can overwrite critical system files. This can lead to a complete takeover of the server by allowing the attacker to execute arbitrary commands with root privileges.

Technical details

The Note Mark application fails to sanitize the 'X-Name' HTTP header during asset uploads via 'POST /api/notes/{noteID}/assets'. This unsanitized string is stored in the database and later used by the CLI migration/export commands ('note-mark migrate export') in 'filepath.Join()' and 'os.Create()' calls. Because 'filepath.Join' resolves '..' sequences, an attacker can provide a path traversal string (e.g., '../../../../bin/bash') to overwrite arbitrary files on the host filesystem. Since the export process often runs with root privileges, this allows for Remote Code Execution (RCE) by overwriting system binaries or configuration files. The vulnerability is patched in version 0.19.4.

Affected products

• enchant97 Note Mark < 0.19.4

Timeline

• 2026-05-01: patched: Fix committed to repository
• 2026-05-07: advisory: GitHub Advisory published

References

• https://api.github.com/users/rvizx
• https://github.com/rvizx
• https://api.github.com/users/rvizx/gists%7B/gist_id%7D
• https://api.github.com/users/rvizx/repos
• https://avatars.githubusercontent.com/u/84989569?v=4
• https://api.github.com/users/rvizx/events%7B/privacy%7D