CVE-2025-53544: falha de alta gravidade em TriliumNext Trilium
Trilium Notes is Vulnerable to Brute-force Protection Bypass via Initial Sync Seed Retrieval
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 0.4%
Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases. In versions below 0.97.0, a brute-force protection bypass in the initial sync seed retrieval endpoint allows unauthenticated attackers to guess the login password without triggering rate limiting. Trilium is a single-user app without a username requirement, and brute-force protection bypass makes exploitation much more feasible. Multiple features provided by Trilium (e.g. MFA, share notes, custom request handler) indicate that Trilium can be exposed to the internet. This is fixed in version 0.97.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
TriliumNext · TriliumCVEs relacionadas — TriliumNext Trilium
No mesmo produto, das mais perigosas para as menos.
CVE-2026-35593MEDIUMTrilium Notes has Local File Inclusion via upload modified file API endpointEPSS 0.6%CVE-2025-68621HIGHTrilium Notes has a Timing Attack Vulnerability in /api/login/syncEPSS 0.6%CVE-2026-53580HIGHTrilium arbitrary file read and denial of service via file:// URLs in the automatic image-download featureEPSS 0.5%CVE-2026-47727HIGHTrilium: RCE via `shareTemplate` relation missing `isDangerous` flag — Safe import bypass leading to EJS SSTI (Incomplete Fix of CVE-2026-45668)EPSS 0.5%CVE-2026-45733HIGHTrilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop appEPSS 0.4%CVE-2026-77438HIGHTrilium unauthenticated share-search discloses password-protected and hidden shared notesEPSS 0.4%