Note Mark's slug validation for books and notes uses an unanchored regex pattern '[a-z0-9-]+' which matches any string containing these characters, allowing path traversal strings to pass validation. The migrate export commands join these unsanitized slugs into filesystem paths using path.Join, which resolves '../' segments, resulting in directory and file creation outside the configured export directory. This vulnerability allows a low-privilege authenticated user to cause the export process, typically run as root, to write files arbitrarily on the filesystem, leading to potential root code execution. This issue is related to but distinct from GHSA-g49p-4qxj-88v3, which fixed asset filename sanitization but left slug sanitization incomplete.

An authenticated user with low privileges can supply crafted book or note slugs containing path traversal sequences. When an administrator runs the export commands (commonly as root), the exporter creates directories and writes files outside the intended export directory. This can lead to arbitrary file creation with root privileges, allowing attackers to place files in sensitive locations such as /etc/cron.d/ or systemd unit directories, potentially resulting in root-level code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid running the 'note-mark migrate export' commands with root privileges or restrict export operations to trusted data only. Monitor for vendor updates addressing slug input sanitization and ensure that slug validation uses anchored regex patterns or explicit sanitization before filesystem operations.