CVE-2026-50553 Details
Description
Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and note slug values with the OpenAPI/huma tag pattern:"[a-z0-9-]+". huma compiles this with regexp.MustCompile(s.Pattern) and tests it with patternRe.MatchString(str), an UNANCHORED match. Because the pattern is not anchored (^...$), any string that merely CONTAINS one [a-z0-9-] substring passes validation. A slug such as ../../../../../../tmp/escape is accepted and stored verbatim. The data-export CLI commands (note-mark migrate export and note-mark migrate export-v1) join these unsanitized slugs straight into the output path with path.Join / filepath.Join, then os.MkdirAll the directory and os.Create the note file. path.Join resolves the ../ segments, so the note content file is written OUTSIDE the configured export directory. The export process commonly runs as root (default in Docker / bare-metal admin usage), so this is a root-privilege arbitrary directory create + file write. This issue has been patched in version 0.19.5.
A path traversal vulnerability has been identified in Note Mark, an open-source note-taking application, prior to version 0.19.5. The issue arises because the application validates book and note slug values using an unanchored regular expression pattern, allowing any string containing a valid substring to pass validation. This flaw enables the inclusion of traversal sequences in slugs, which are then stored verbatim. When the data-export CLI commands are executed, these unsanitized slugs are directly appended to the output path, creating directories and files based on the attacker's input. Notably, the export process often runs with root privileges, leading to unauthorized file writes outside the designated export directory, potentially escalating to code execution as root.
Users can update to Note Mark version 0.19.5 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 4, 2026CISA-ADP
Assessed Sep 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/enchant97/note-mark/security/advisories/GHSA-rqrh-8wpv-x7hh | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/enchant97/note-mark/commit/67b7de04308a858ef27ceff87b514067b6d667e5 | [email protected] | Source CodeVendor |
| https://github.com/enchant97/note-mark/releases/tag/v0.19.5 | [email protected] | Release NotesVendor |
| https://github.com/enchant97/note-mark/security/advisories/GHSA-rqrh-8wpv-x7hh | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| enchant97/note-mark | <= 0.19.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 4, 2026 | New CVE Received | [email protected] |
| Sep 4, 2026 | CVE Modified | CISA-ADP |