Note Mark versions prior to 0.19.5 are vulnerable to a path traversal flaw that permits unauthorized file creation with root privileges, posing a severe risk to system integrity.

The application improperly validates input slugs using an unanchored regular expression, which allows attackers with low privileges to inject path traversal sequences. These sequences are subsequently utilized by the export CLI commands to write files to arbitrary locations on the host filesystem with root privileges.

Successful exploitation of this vulnerability allows an attacker to overwrite critical system configuration files or place malicious scripts, potentially leading to a full system compromise. With a CVSS score of 8.6, this flaw represents a high risk to business operations, as the export process often executes with elevated privileges, bypassing standard directory restrictions.

Immediate Action: Upgrade to Note Mark version 0.19.5 or later, which contains the corrected input validation logic.

Proactive Monitoring: Monitor server logs for unexpected file write operations or CLI commands involving unusual path structures, especially those originating from the data-export utility.

Compensating Controls: Restrict access to the note-taking application to trusted users only and ensure the application runs in a containerized environment with strictly enforced least-privilege filesystem permissions to limit the scope of potential file writes.

Public Exploit Available: Unknown.

This vulnerability presents a significant risk due to the potential for arbitrary file writes at the root level. Administrators should prioritize patching the Note Mark installation immediately to version 0.19.5. Given the presence of a proof-of-concept, the urgency of this update is high to prevent potential exploitation.