Executive brief
Trilium is an open-source note-taking application with built-in automatic image downloading. A vulnerability in versions prior to 0.104.0 allows authenticated users to read any file accessible to the Trilium process and cause denial-of-service crashes by embedding specially crafted image tags in notes. Because the feature is enabled by default and reachable through multiple interfaces (web UI, API, web clipper, imports), any user with a login or API token can exploit this without special privileges.
Technical details
This is a path-traversal / arbitrary-file-read vulnerability in Trilium's automatic image-download feature. When a note containing HTML is saved, Trilium's `downloadImage()` function (notes.ts:618-635) accepts `file://` URLs, strips the protocol prefix, and passes the remainder directly to `fs.readFile()` with no path validation, canonicalization, or size checks. Because the HTML sanitizer preserves `file://` as an allowed protocol (shared_constants.ts:17), attackers can inject `<img src="file:///etc/passwd">` and similar payloads into notes via the web UI, ETAPI (`PUT /etapi/notes/:noteId/content`), web clipper, or import functions. The downloaded file content is stored as a note attachment, leaking sensitive data. Additionally, pointing the same primitive at unbounded resources like `/dev/zero` causes uncontrolled memory allocation leading to process crashes. Exploitation requires only an authenticated session or ETAPI token (no admin role). The fix is available in version 0.104.0.
Affected products
- TriliumNext Trilium prior to 0.104.0
Timeline
- 2026-08-27: disclosed
- 0.104.0: patched