Authenticated users can upload an asset by supplying an arbitrary filename in the X-Name header. The application stores this name without validation, allowing attackers to embed path traversal sequences. When an administrator later exports data, the unsanitized name is fed into filepath.Join() and path.Join(), causing the export process to write files to arbitrary locations on the host, enabling the attacker to place files where they can be executed or otherwise compromise the system. This flaw maps to CWE‑20 (Improper Input Validation) and CWE‑22 (Path Traversal).

The vulnerability affects Note Mark versions 0.13.0 through 0.19.3 inclusive. The affected product is the open‑source Note Mark note‑taking application developed by enchant97. All users who can upload assets via the API and those with administrator privileges who run the export command are susceptible. Versions 0.19.4 and newer contain the fix.

The CVSS score of 8.6 signals high severity. EPSS information is currently unavailable, but the flaw is not listed in the CISA KEV catalog. The attack requires authentication and the ability to use the API for asset upload followed by an administrator running the CLI export command; thus the vector is local to the application’s authenticated realm but can lead to full system compromise once exploited.