Note Mark is an open-source note-taking application. Before version 0.19.5, it validates book and note slug values with an unanchored regex pattern "[a-z0-9-]+", which allows any string containing a matching substring to pass validation. This permits slugs like '../../../../../../tmp/escape' to be accepted and stored verbatim. The migrate export CLI commands join these unsanitized slugs into output paths using path.Join/filepath.Join, which resolves '../' sequences, resulting in files being written outside the intended export directory. Since the export process commonly runs as root, this leads to a root-privilege arbitrary directory creation and file write vulnerability. The issue is fixed in version 0.19.5.

An attacker can craft malicious book or note slugs containing path traversal sequences that bypass validation and cause the export process to write files outside the designated export directory. Because the export process often runs with root privileges, this can lead to arbitrary file creation or overwriting with root-level permissions, potentially compromising system integrity or security.

This vulnerability is patched in Note Mark version 0.19.5. Users should upgrade to version 0.19.5 or later to remediate this issue. No additional mitigation steps are required if the upgrade is applied.