Unrated

Path Traversal in Note Mark migrate export functionality

IdentifiersCVE-2026-50553CWE-22

CVE-2026-50553 is a path traversal vulnerability in Note Mark's migration export functionality. The flaw affects export operations that use book and note slug values to construct filesystem paths without sufficient sanitization or strict validation. Unsanitized slug values can contain traversal sequences that escape the configured export directory, allowing files and directories to be created in unintended filesystem locations. The issue affects administrative export commands, including the migrate export workflows, where attacker-controlled or user-supplied metadata is later processed by a higher-privileged export routine. The vulnerable behavior stems from improper restriction of path components before path joining, enabling directory traversal during file write operations.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

A low-privilege authenticated user can influence filesystem write locations by supplying crafted slug values that are later consumed by an administrative export process. Successful exploitation can result in arbitrary file write outside the intended export directory. Depending on where files are written and the privileges of the export process, this may enable overwriting or planting files in sensitive locations, leading to integrity compromise, service disruption, persistence, or privilege escalation. If the export command is executed with root privileges, the vulnerability can potentially be escalated to root-level code execution through writes into privileged execution paths such as scheduled task or service configuration locations.

Mitigation

If you can’t patch tonight, do this now.

Until a fixed version is deployed, do not run the affected migration export commands on instances containing untrusted or user-controlled books or notes. If export is operationally necessary, execute it as a non-root account inside a tightly confined environment with minimal filesystem access. Independently validate or sanitize stored slug and related username fields before export, restrict write permissions so the export process cannot modify sensitive paths, and monitor for unexpected file creation outside the designated export directory.

Remediation

Patch, then assume compromise.

Upgrade Note Mark to a fixed release containing the vendor's path validation and sanitization changes. The documented fix anchors slug and username validation patterns with strict regular expressions and sanitizes export path components before joining them. The advisory indicates that builds containing commit 67b7de04308a or later address the issue. After upgrading, review any locally modified export logic to ensure all path components are normalized and constrained to the intended export root.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

No public activity tracked yet. Mallory keeps watching.

0 SOURCESView more in app

No public activity observed for this vulnerability.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity