Executive brief
flatnotes is a self-hosted note-taking application. A security flaw in its attachment handling allows users to upload malicious files, such as specially crafted HTML or SVG documents. If another user or administrator views these files, the attacker can execute malicious scripts in their browser, potentially leading to unauthorized access to notes or account takeover.
Technical details
An arbitrary file upload vulnerability exists in the attachment handling component of flatnotes v5.5.4. The application's filesystem attachment backend validates filename structure but fails to restrict active file extensions like .html or .svg. When these files are requested via /api/attachments/{filename} or /attachments/{filename}, they are served using FileResponse with their original content types (text/html or image/svg+xml) rather than being forced to download. This allows an authenticated attacker to perform stored Cross-Site Scripting (XSS) by uploading a malicious file that executes within the application's origin when viewed by other users. This can lead to session hijacking or unauthorized actions performed on behalf of the victim.
Affected products
- flatnotes flatnotes 5.5.4
Timeline
- 2026-06-13: disclosed: Initial discovery and Gist publication
- 2026-06-15: advisory: CVE published to NVD dataset