An authenticated file disclosure and denial of service vulnerability in Trilium allows attackers to access sensitive local files or crash the server process.

The application fails to validate file paths when processing image sources in note HTML, permitting an authenticated user to leverage the file scheme to read sensitive system files or trigger resource exhaustion via device files like /dev/zero.

Successful exploitation of this vulnerability permits an authenticated attacker to exfiltrate sensitive data from the host filesystem, potentially compromising credentials or configuration files. Furthermore, the ability to induce uncontrolled memory allocation poses a significant risk of service disruption, impacting the availability of the note-taking infrastructure. With a CVSS score of 8.1, this represents a high-severity threat that necessitates immediate attention to prevent unauthorized data access and unplanned downtime.

Immediate Action: Upgrade to Trilium version 0.104.0 or later to ensure the image-download feature correctly sanitizes and restricts file system access.

Proactive Monitoring: Review application access logs for unusual image source patterns or repeated requests containing file:// URI schemes.

Compensating Controls: If immediate patching is not feasible, restrict network access to the Trilium ETAPI and monitor for anomalous server memory consumption that may indicate exploitation attempts.

Public Exploit Available: No confirmed public exploit or proof-of-concept exists in the provided data.

Given the potential for both unauthorized file disclosure and system instability, organizations should prioritize the update to version 0.104.0. The ability for any authenticated user to trigger this vulnerability makes it a critical concern for multi-user environments. Apply the vendor-supplied patch immediately to eliminate the risk of file system exposure and server crashes.