Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-54053— Many Notes: Path Traversal via ZIP import allows arbitrary file write and stored XSS in other users' vaults

Quick assessment

Affected
brufdev many-notes
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

译文： Many Notes 是一个旨在提供简洁体验的 Markdown 笔记 Web 应用。在 0.16.0 之前，由 实现的 ZIP 保险库导入功能，允许接受包含父级目录遍历片段（即 等路径片段）的归档文件名称。已认证的用户因此能够在导入用户的保险库之外写入任意文件，甚至可以向其他用户的保险库中写入文件，包括覆盖已有文件。攻击者还可以在另一用户的保险库中植入伪装成 SVG 的内容，当受害者打开该保险库时，这些 SVG 内容将触发存储型跨站脚本攻击（Stored XSS）。该问题已在版本 0.16.0 中修复。

CVSS 9.6 · Critical
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-54053

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Many Notes: Path Traversal via ZIP import allows arbitrary file write and stored XSS in other users' vaults
Source: CVE Program / CVE List V5
Vulnerability Description
Many Notes is a Markdown note-taking web application designed for simplicity. Prior to 0.16.0, the ZIP vault import implemented in app/Actions/ProcessImportedVault.php accepts archive filenames containing parent-directory traversal segments. An authenticated user can write arbitrary files outside the importing user's vault and into other users' vaults, including overwriting existing files. Disguised SVG content can be placed in another user's vault and execute stored cross-site scripting when the victim opens that vault. This issue is fixed in version 0.16.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
brufdev many-notes < 0.16.0 -

II. Public POCs for CVE-2026-54053

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-54053

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-54053 (1)

Vendor Advisories for CVE-2026-54053 (1)

Vendor Pages for CVE-2026-54053 (1)

IV. Related Vulnerabilities

Same weakness: CWE-22

V. Comments for CVE-2026-54053

No comments yet

Leave a comment