CVE-2026-53580: CWE-73: External Control of File Name or Path in TriliumNext Trilium

TriliumNext's Trilium application versions before 0.104.0 contain an external control of file name or path vulnerability (CWE-73) in its automatic image-download feature. This feature processes file:// URLs in img tags without validating the path, allowing authenticated users to read arbitrary files accessible to the Trilium process by embedding file URLs in notes. The HTML sanitizer permits the file scheme, so file URLs like file:///etc/passwd are read and stored as note attachments. Additionally, referencing unbounded sources such as /dev/zero can cause uncontrolled memory allocation, leading to server crashes (CWE-400). The feature is enabled by default and accessible via multiple interfaces, requiring only authentication or an ETAPI token. The vulnerability is addressed in version 0.104.0.

An authenticated user can disclose arbitrary local files readable by the Trilium process, potentially exposing sensitive information. The vulnerability also allows denial of service by crashing the server through memory exhaustion when referencing unbounded sources like /dev/zero. The confidentiality and availability of the Trilium service are impacted, with no integrity impact reported.

Upgrade to Trilium version 0.104.0 or later, where this vulnerability is fixed. Until then, restrict access to authenticated users and ETAPI tokens carefully to trusted parties. Patch status is confirmed by the vendor advisory indicating the fix in version 0.104.0.