CVE-2026-35593 | TriliumNext Trilium up to 0.102.1 upload-modified-file uploadModifiedFileToAttachment path traversal (GHSA-hf4x-22rg-pjjp)

A vulnerability identified as critical has been detected in TriliumNext Trilium up to 0.102.1. Impacted is the function uploadModifiedFileToAttachment of the file /api/attachments/{attachmentId}/upload-modified-file. This manipulation causes path traversal.

This vulnerability is registered as CVE-2026-35593. Remote exploitation of the attack is possible. No exploit is available.

You should upgrade the affected component.