8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44522

CVE-2026-44522: Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leading to Remote Code Execution

Note Mark is an open-source note-taking application. From 0.13.0 to before 0.19.4, the Note Mark application allows authenticated users to upload assets to notes via POST /api/notes/{noteID}/assets, where the asset filename is provided through the X-Name HTTP request header. This value is stored directly in the database without any sanitization or validation - no path separator filtering, no directory traversal sequence rejection, and no use of filepath.Base() to strip directory components. The unsanitized name is persisted as-is in the note_assets table (Name column, varchar(80)). When an administrator subsequently runs the data export CLI commands (note-mark migrate export-v1 or note-mark migrate export), the stored asset name is passed directly into filepath.Join() and path.Join() calls as part of the output file path argument to os.Create(). Since Go's filepath.Join() resolves ../ sequences during path normalization, an attacker-controlled asset name containing directory traversal sequences causes the export process to write files to arbitrary locations on the filesystem, completely outside the intended export directory. This vulnerability is fixed in 0.19.4.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44522

CVE-2026-44522:

8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/enchant97/note-mark/backend	go	< 0.0.0-20260501152243-db3f72bff780	0.0.0-20260501152243-db3f72bff780

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic path traversal that leads to arbitrary file write and potential remote code execution. The root cause is the lack of input validation on the X-Name HTTP header, which is used as a filename for uploaded assets.

The exploitation occurs in two stages:

Injection: An authenticated attacker uploads an asset and provides a malicious filename containing path traversal sequences (e.g., ../../../../../../etc/passwd) in the X-Name header. The AssetsHandler.PostNoteAsset function in backend/handlers/assets.go accepted this input without sanitization and stored it in the database.
Execution: When an administrator triggers a data export using the application's CLI, the commandMigrateExportData or commandMigrateExportDataV1 functions in backend/cli/migrate.go are executed. These functions read the malicious filename from the database and use it to construct a file path for the exported asset. The filepath.Join and path.Join functions normalize this path, causing the file to be written outside the intended export directory. If the process is running as a privileged user (e.g., root), the attacker can overwrite critical system files, leading to remote code execution.

The patch addresses the vulnerability at both stages. It adds input validation in AssetsHandler.PostNoteAsset to reject filenames with path separators. As a defense-in-depth measure, it also modifies the export functions to sanitize the filename using filepath.Base() before using it, preventing exploitation even if malicious data already exists in the database.

Vulnerable functions

AssetsHandler.PostNoteAsset

backend/handlers/assets.go

This function handles asset uploads. Before the patch, it directly processed the `X-Name` header as the asset's filename without any validation. This allowed an attacker to provide a filename with path traversal sequences (e.g., `../../file`), which would then be stored in the database.

commandMigrateExportData

backend/cli/migrate.go

This function is used for data export. It retrieves asset filenames from the database and uses them to create files in the export directory. Because the filename was not sanitized, a malicious filename stored in the database could cause `os.Create` to write a file outside the intended directory due to path traversal.

commandMigrateExportDataV1

backend/cli/migrate.go

This function is used for the v1 data export. Similar to `commandMigrateExportData`, it was vulnerable to path traversal because it used unsanitized asset filenames from the database to create files, allowing an attacker to write files to arbitrary locations on the filesystem.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.