Executive brief
Note Mark is a self-hosted note-taking application. A vulnerability in its data export feature allows a standard user to create notes with specially crafted names that trick the system into writing files to restricted areas of the server's filesystem. If an administrator performs a backup or migration, an attacker could potentially gain full control of the server by overwriting critical system files.
Technical details
A path traversal vulnerability exists in Note Mark's migration export functionality (`migrate export` and `migrate export-v1`). The application uses unanchored regular expressions (`[a-z0-9-]+`) to validate 'slug' fields for books and notes, allowing strings containing traversal sequences (e.g., `../../`) to be stored in the database. When an administrator executes an export command, these unsanitized slugs are passed to `path.Join` or `filepath.Join`, which resolves the sequences and allows the exporter to write `_index.md` files outside the intended export directory. Since these processes often run with root privileges (especially in Docker environments), an attacker can achieve arbitrary file write and potential remote code execution by targeting system directories like `/etc/cron.d/`.
Affected products
- enchant97 Note Mark <= 0.19.4
Timeline
- 2026-06-01: patched: Fix committed to repository
- 2026-07-09: advisory: Public advisory published