# CVE-2026-50553: Note Mark path traversal in migrate export via unsanitized slugs

Source: https://junglewise.ai/threats/cve-2026-50553-note-mark-path-traversal-in-migrate-export-via-unsanitized-slugs  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2026-50553 · Severity: high · CVSS 4 · Published 2026-09-04

Note Mark is a self-hosted note-taking application. A vulnerability in its data export feature allows a standard user to create notes with specially crafted names that trick the system into writing files to restricted areas of the server's filesystem. If an administrator performs a backup or migration, an attacker could potentially gain full control of the server by overwriting critical system files.

Technologies: [Enchant97 Note Mark](https://junglewise.ai/threats/technologies/note-mark), [github.com/enchant97/note-mark/backend (Go)](https://junglewise.ai/threats/technologies/github-com-enchant97-note-mark-backend). Vendors: [Enchant97](https://junglewise.ai/threats/vendors/enchant97), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-50553 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50553 being exploited in the wild.

**How severe is CVE-2026-50553?** High severity, with a CVSS score of 4, published 4 September 2026.

**Which products and versions are affected?** Enchant97 Note Mark <= 0.19.4; github.com/enchant97/note-mark/backend (Go) < 0.0.0-20260601210719-67b7de04308a, SEMVER:introduced=0,fixed=0.0.0-20260601210719-67b7de04308a.

**Is there a fix for CVE-2026-50553?** Yes. github.com/enchant97/note-mark/backend (Go): upgrade to 0.0.0-20260601210719-67b7de04308a or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50553 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-50553?** Check whether you run Enchant97 Note Mark or github.com/enchant97/note-mark/backend (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/enchant97/note-mark/backend (Go): upgrade to 0.0.0-20260601210719-67b7de04308a or later

  ```sh
  go get github.com/enchant97/note-mark/backend@v0.0.0-20260601210719-67b7de04308a
  ```


## Technical details

A path traversal vulnerability exists in Note Mark's migration export functionality (`migrate export` and `migrate export-v1`). The application uses unanchored regular expressions (`[a-z0-9-]+`) to validate 'slug' fields for books and notes, allowing strings containing traversal sequences (e.g., `../../`) to be stored in the database. When an administrator executes an export command, these unsanitized slugs are passed to `path.Join` or `filepath.Join`, which resolves the sequences and allows the exporter to write `_index.md` files outside the intended export directory. Since these processes often run with root privileges (especially in Docker environments), an attacker can achieve arbitrary file write and potential remote code execution by targeting system directories like `/etc/cron.d/`.

## Affected products

- enchant97 Note Mark <= 0.19.4

## Identifiers

- CVE-2026-50553
- GHSA-rqrh-8wpv-x7hh
- GO-2026-5949

## Timeline

- 2026-06-01: patched: Fix committed to repository
- 2026-07-09: advisory: Public advisory published

## References

- [https://api.github.com/users/tonghuaroot](https://api.github.com/users/tonghuaroot)
- [https://github.com/tonghuaroot](https://github.com/tonghuaroot)
- [https://api.github.com/users/tonghuaroot/gists%7B/gist_id%7D](https://api.github.com/users/tonghuaroot/gists%7B/gist_id%7D)
- [https://api.github.com/users/tonghuaroot/repos](https://api.github.com/users/tonghuaroot/repos)
- [https://avatars.githubusercontent.com/u/23011166?v=4](https://avatars.githubusercontent.com/u/23011166?v=4)
- [https://api.github.com/users/tonghuaroot/events%7B/privacy%7D](https://api.github.com/users/tonghuaroot/events%7B/privacy%7D)

## Related threats

- [Note Mark information disclosure of soft-deleted notes in public books](https://junglewise.ai/threats/cve-2026-50554-note-mark-information-disclosure-of-soft-deleted-notes-in-public)
- [enchant97 Note Mark weak JWT secret allows account takeover](https://junglewise.ai/threats/cve-2026-44523-enchant97-note-mark-weak-jwt-secret-allows-account-takeover)
- [enchant97 Note Mark path traversal in asset upload](https://junglewise.ai/threats/cve-2026-44522-enchant97-note-mark-path-traversal-in-asset-upload)
- [Note Mark: Unauthenticated read of notes and assets in soft-deleted public books](https://junglewise.ai/threats/cve-2026-41572-note-mark-unauthenticated-read-of-notes-and-assets-in-soft)
- [Note Mark: OIDC-registered users authenticated by submitting password "null"](https://junglewise.ai/threats/cve-2026-41571-note-mark-oidc-registered-users-authenticated-by-submitting)