https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-77438.htmlhttps://patchthecve.com/cve/CVE-2026-77438.htmlWed, 14 Oct 2026 15:36:52 +0000HIGH 7.5: Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public share-search endpoint does not enforce the per-note shareCredentials and shareHiddenFromTree controls, allowing an unauthenticated visitor to read the titles, tree paths, and content ohttps://patchthecve.com/cve/CVE-2026-53580.htmlhttps://patchthecve.com/cve/CVE-2026-53580.htmlWed, 14 Oct 2026 15:41:49 +0000HIGH 8.1: Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the automatic image-download feature accepts file:// URLs in a note's img tags and reads the referenced local file with no path validation, allowing any authenticated user to disclose arbitrary files readabhttps://patchthecve.com/cve/CVE-2026-53579.htmlhttps://patchthecve.com/cve/CVE-2026-53579.htmlWed, 14 Oct 2026 15:46:18 +0000MEDIUM 6.1: Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the book note type, whose content is stored without sanitization and later rendered as HTML, allowing an attackhttps://patchthecve.com/cve/CVE-2026-53578.htmlhttps://patchthecve.com/cve/CVE-2026-53578.htmlWed, 14 Oct 2026 15:49:44 +0000MEDIUM 6.1: Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the mindMap note type, whose JSON content is stored without sanitization, allowing an attacker-supplied import https://patchthecve.com/cve/CVE-2026-48996.htmlhttps://patchthecve.com/cve/CVE-2026-48996.htmlWed, 14 Oct 2026 15:51:48 +0000MEDIUM 6.1: Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter does not sanitize note titles, and the GeoMap note view interpolates a marker note's title into raw HTML that is rendered as innerHTML, allowing an attacker-suhttps://patchthecve.com/cve/CVE-2026-47727.htmlhttps://patchthecve.com/cve/CVE-2026-47727.htmlWed, 14 Oct 2026 15:52:52 +0000HIGH 8.8: Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the default-on "Safe import" filter fails to neutralize the shareTemplate relation because that relation is not marked as dangerous, allowing an attacker-supplied import archive to plant a server-side templ