Trilium’s automatic image-download feature accepts file:// URLs inside note img tags and, without validating the path, reads any local file reachable by the Trilium process. This allows an authenticated user to retrieve arbitrary file contents by saving the note, which is stored as an attachment, or to trigger a denial‑of‑service by pointing the source at an unbounded file such as /dev/zero, causing uncontrolled memory allocation and server crash. The flaw is a result of CWE‑400, CWE‑552, and CWE‑73 weaknesses in the sanitizer and file access logic.

Vulnerable versions are all releases of Trilium prior to 0.104.0. In affected installations the flaw can be triggered via the web UI, the ETAPI, the web clipper, or note imports, requiring only an authenticated session or an API token. No version after 0.104.0 is known to be affected.

The vulnerability scores a CVSS of 8.1, indicating high severity. The EPSS score is unavailable, so exploitation likelihood is uncertain, and the flaw is not listed in CISA’s KEV catalog. Because an attacker must have an authenticated session to exploit the issue, the risk is limited to trusted users or compromised accounts; however the potential for data exposure and DoS remains significant for any affected deployment.