Is CVE-2026-45668 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45668 being exploited in the wild.

How severe is CVE-2026-45668?

Informational severity, with a CVSS score of 9.3, published 29 May 2026.

Which products and versions are affected?

TriliumNext Trilium Notes < 0.102.2.

Is there a fix for CVE-2026-45668?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-45668 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-45668?

Check whether you run TriliumNext Trilium Notes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45668: Trilium Notes RCE via path traversal in ZIP import

Q: Is there a fix for CVE-2026-45668?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-45668 attacked?

It is attacked with local access, in a network appliance.

Q: Am I affected by CVE-2026-45668?

Check whether you run TriliumNext Trilium Notes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45668 · Severity: info · CVSS 9.3 · Published 2026-05-29

Trilium Notes is a hierarchical note-taking application used to build personal knowledge bases. A security vulnerability allows an attacker to execute malicious code on a user's computer if the user imports a specially crafted ZIP archive, even if 'Safe Import' mode is enabled. This could lead to a full system compromise, allowing an attacker to steal data, install malware, or disrupt operations.

Vendors: TriliumNext.

Quick answers

Is CVE-2026-45668 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45668 being exploited in the wild.
How severe is CVE-2026-45668?: Informational severity, with a CVSS score of 9.3, published 29 May 2026.
Which products and versions are affected?: TriliumNext Trilium Notes < 0.102.2.
Is there a fix for CVE-2026-45668?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-45668 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-45668?: Check whether you run TriliumNext Trilium Notes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Trilium Notes prior to version 0.102.2 is vulnerable to Remote Code Execution (RCE) triggered by a malicious ZIP archive import. The vulnerability stems from a path traversal flaw in the '#docName' label handling within the Doc renderer component. An attacker can craft a ZIP file containing a payload note (type: code, mime: text/plain) and a trigger note (type: doc or launcher) that uses a '../' sequence in its #docName attribute to point to the payload's API endpoint. Because 'Safe Import' does not sanitize text/plain notes or the docName label, the payload is stored and then executed via XSS when the trigger note is rendered. Since the Electron desktop client runs with 'nodeIntegration' enabled, the XSS leads directly to RCE. The issue is fixed in version 0.102.2.

Affected products

TriliumNext Trilium Notes < 0.102.2

Timeline

2026-05-11: advisory: GitHub advisory published
2026-05-29: disclosed: CVE published to NVD

References

https://github.com/TriliumNext/Trilium/security/advisories/GHSA-9jjc-cccq-f6rh

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.