CVE-2026-54053: Many Notes: Path Traversal via ZIP import allows arbitrary file write and stored XSS in other users' vaults
Many Notes is a Markdown note-taking web application designed for simplicity. Prior to 0.16.0, the ZIP vault import implemented in app/Actions/ProcessImportedVault.php accepts archive filenames containing parent-directory traversal segments. An authenticated user can write arbitrary files outside the importing user's vault and into other users' vaults, including overwriting existing files. Disguised SVG content can be placed in another user's vault and execute stored cross-site scripting when the victim opens that vault. This issue is fixed in version 0.16.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Many Notesto a version that resolves this vulnerability.Fixed in 0.16.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Many Notes user can exploit the vulnerable ZIP vault import. No victim interaction is required for the file-write portion; stored XSS can execute when another user opens the affected vault.
Which deployments are affected?
Many Notes versions prior to 0.16.0 are affected where ZIP vault import is available. The vulnerability is in the ZIP vault import processing path.
What can an attacker do?
An attacker can use parent-directory traversal entries in an imported archive to write files outside their own vault, including into other users' vaults and over existing files. They can also place disguised SVG content that triggers stored XSS when a victim opens the impacted vault.
What should be done if patching cannot happen immediately?
The provided information identifies ZIP vault import as the affected feature. Restricting access to that import capability can reduce exposure until upgrading to version 0.16.0.