CyberRota Analysis
AI-GeneratedThe vulnerability allows authenticated users of the Many Notes Markdown note-taking web application to exploit the ZIP vault import feature, enabling them to write arbitrary files outside their own vaults and into other users' vaults. This can lead to overwriting existing files and executing stored cross-site scripting attacks through disguised SVG content when victims access their vaults. Organizations using versions prior to 0.16.0 should prioritize updating to the latest version to mitigate this critical risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Many Notes is a Markdown note-taking web application designed for simplicity. Prior to 0.16.0, the ZIP vault import implemented in app/Actions/ProcessImportedVault.php accepts archive filenames containing parent-directory traversal segments. An authenticated user can write arbitrary files outside the importing user's vault and into other users' vaults, including overwriting existing files. Disguised SVG content can be placed in another user's vault and execute stored cross-site scripting when the victim opens that vault. This issue is fixed in version 0.16.0.