CVE-2026-53580: Trilium arbitrary file read and denial of service via file:// URLs in the automatic image-download feature
Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the automatic image-download feature accepts file:// URLs in a note's img tags and reads the referenced local file with no path validation, allowing any authenticated user to disclose arbitrary files readable by the Trilium process. When a text note is saved, Trilium scans its HTML for image sources and downloads each external one; because the HTML sanitizer keeps file as an allowed scheme, a source such as file:///etc/passwd is passed straight to a filesystem read and its contents are stored as a note attachment the user can then retrieve. Pointing the same primitive at an unbounded source such as /dev/zero causes uncontrolled memory allocation that crashes the server process. The feature is enabled by default and is reachable through the web UI, the ETAPI, the web clipper, and note imports, requiring only an authenticated session or an ETAPI token. This issue is fixed in version 0.104.0
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Trilium automatic image-download featureto a version that resolves this vulnerability.Fixed in 0.104.0 - Configuration
Disable the automatic image-download feature or block file:// URLs in note img tag sources if you cannot upgrade to Trilium 0.104.0, to prevent arbitrary file read and uncontrolled memory allocation from sources like file:///etc/passwd or /dev/zero.
Trilium automatic image-download feature (file:// URL handling) = disabled
Event History
Frequently Asked Questions
Who can exploit this issue?
Any user with an authenticated Trilium session or an ETAPI token can exploit it. The affected image-download feature is enabled by default and can be reached through the web UI, ETAPI, web clipper, or note imports.
What access and conditions are required for exploitation?
An attacker needs the ability to submit or save note HTML containing an img tag with a file:// source. No user interaction beyond the attacker saving or submitting the note is required.
What can an attacker access or disrupt?
They can read files that the Trilium process is permitted to read, with the contents stored as a note attachment they can retrieve. They can also point the feature at an unbounded source such as /dev/zero to trigger uncontrolled memory allocation and crash the server process.
Which versions are affected and what is the fix?
Versions prior to 0.104.0 are affected. Upgrade to Trilium 0.104.0, which fixes the issue.