CVE-2026-47727 is a high severity (CVSS 8.8) code injection flaw in the Trilium note-taking app. The default Safe import filter misses one relation, so an imported archive can plant a template that runs on the server when a note is shared. Upgrade to 0.104.0.
What's affected
- Trilium: versions 0.103.0 and earlier. Fixed in 0.104.0.
The GitHub advisory lists the Docker package and rates the issue High, without a CVSS score on the page. The record scores it 8.8 (CVSS 3.1, High). Both agree on High.
The scenario needs a victim to import an attacker-supplied archive and later publish the imported note. After that, the advisory says an unauthenticated request to the shared note is enough to run the code.
How to check if you're exposed
Open the About dialog in Trilium to read the version. For Docker deployments, check the image tag:
docker ps --format '{{.Image}}' | grep -i trilium
Then look at whether any notes were imported from archives you did not create, and whether any of them are published through the share feature. Shared notes are the part of the app reachable without a login.
What to do now
- Upgrade to Trilium 0.104.0 or later.
- Do not import ZIP archives from untrusted sources. The advisory does not list a workaround, so treat this as precaution based on the root cause.
- Review which imported notes are published and unshare any you do not recognise.
- Run the server under a user with limited file and network access, so server-side code has less to reach.
- Keep the instance off the public internet unless you need sharing.
Why it matters
The record lists CWE-94, code injection, and CWE-1336, improper neutralization of special elements in a template engine. Trilium has a built-in list of dangerous note attributes that are disabled on import. The shareTemplate relation was left off that list, so it survived an import even with Safe import on.
When the imported note is later published, the public share renderer feeds a linked note's content into the EJS template engine, which compiles it inside the server process. That gives the code access to the filesystem and network. The fix is to mark the relation dangerous so import disables it. The record does not flag this CVE as known exploited.
Quick check
Does the Safe import setting protect me?
Not against this flaw. The setting was on by default, and the missing relation in its list is the cause. Upgrade to 0.104.0.
Does the attacker need an account on my server?
The advisory describes an attacker-supplied archive that a victim imports and publishes. After that, the request to the shared note is unauthenticated.
Sources
Last reviewed: 18 October 2026.
