CVE-2026-54053 Details
Description
Many Notes is a Markdown note-taking web application designed for simplicity. Prior to 0.16.0, the ZIP vault import implemented in app/Actions/ProcessImportedVault.php accepts archive filenames containing parent-directory traversal segments. An authenticated user can write arbitrary files outside the importing user's vault and into other users' vaults, including overwriting existing files. Disguised SVG content can be placed in another user's vault and execute stored cross-site scripting when the victim opens that vault. This issue is fixed in version 0.16.0.
A path traversal vulnerability has been identified in Many Notes, a Markdown note-taking web application, in versions prior to 0.16.0. The issue arises in the ZIP vault import feature, which accepts archive filenames with parent-directory traversal segments. This vulnerability allows authenticated users to write arbitrary files outside their own vaults and into those of other users, potentially overwriting existing files. Additionally, disguised SVG content can be injected into another user's vault, executing stored cross-site scripting when the vault is accessed.
Users can update to Many Notes version 0.16.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2026CISA-ADP
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/brufdev/many-notes/commit/1b3288fa9671002e72e38b7fcd5d226673ba0cae | [email protected] | Source CodeVendor |
| https://github.com/brufdev/many-notes/releases/tag/v0.16.0 | [email protected] | Release NotesVendor |
| https://github.com/brufdev/many-notes/security/advisories/GHSA-wg8j-9c2g-xh6r | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| brufdev/many-notes | <= 0.15.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2026 | New CVE Received | [email protected] |