CVE-2026-50553: Note Mark path traversal in migrate export via unsanitized slugs

CVE-2026-50553 · Severity: high · CVSS 4 · Published 2026-09-04

Note Mark is a self-hosted note-taking application. A vulnerability in its data export feature allows a standard user to create notes with specially crafted names that trick the system into writing files to restricted areas of the server's filesystem. If an administrator performs a backup or migration, an attacker could potentially gain full control of the server by overwriting critical system files.

Technologies: Enchant97 Note Mark, github.com/enchant97/note-mark/backend (Go). Vendors: Enchant97, Go.

Quick answers

Is CVE-2026-50553 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-50553 being exploited in the wild.
How severe is CVE-2026-50553?
High severity, with a CVSS score of 4, published 4 September 2026.
Which products and versions are affected?
Enchant97 Note Mark <= 0.19.4; github.com/enchant97/note-mark/backend (Go) < 0.0.0-20260601210719-67b7de04308a, SEMVER:introduced=0,fixed=0.0.0-20260601210719-67b7de04308a.
Is there a fix for CVE-2026-50553?
Yes. github.com/enchant97/note-mark/backend (Go): upgrade to 0.0.0-20260601210719-67b7de04308a or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50553 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-50553?
Check whether you run Enchant97 Note Mark or github.com/enchant97/note-mark/backend (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/enchant97/note-mark/backend (Go): upgrade to 0.0.0-20260601210719-67b7de04308a or later
    go get github.com/enchant97/note-mark/backend@v0.0.0-20260601210719-67b7de04308a

Technical details

A path traversal vulnerability exists in Note Mark's migration export functionality (`migrate export` and `migrate export-v1`). The application uses unanchored regular expressions (`[a-z0-9-]+`) to validate 'slug' fields for books and notes, allowing strings containing traversal sequences (e.g., `../../`) to be stored in the database. When an administrator executes an export command, these unsanitized slugs are passed to `path.Join` or `filepath.Join`, which resolves the sequences and allows the exporter to write `_index.md` files outside the intended export directory. Since these processes often run with root privileges (especially in Docker environments), an attacker can achieve arbitrary file write and potential remote code execution by targeting system directories like `/etc/cron.d/`.

Affected products

  • enchant97 Note Mark <= 0.19.4

Identifiers

  • CVE-2026-50553
  • GHSA-rqrh-8wpv-x7hh
  • GO-2026-5949

Timeline

  • 2026-06-01: patched: Fix committed to repository
  • 2026-07-09: advisory: Public advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.