CVE-2026-50873: An arbitrary file upload vulnerability in the attachment handling component of flatnotes v5

Synopsis

An arbitrary file upload vulnerability in the attachment handling component of flatnotes v5.5.4 allows unauthenticated remote attackers to upload crafted HTML or SVG files and execute arbitrary code on the server. The vulnerability is reachable over the network, requires no authentication, and no victim interaction is necessary. Successful exploitation gives the attacker full control over the host, including the ability to read, modify, or destroy all data accessible by the running process. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attachment handling endpoint is exposed over the network, so an attacker must be able to reach the service via HTTP or HTTPS from any remote location.

• AuthenticationNot required

  No account or credentials of any kind are needed; the vulnerable upload endpoint is accessible to unauthenticated requests.

• Victim interactionNot required

  The attacker uploads a crafted file directly to the server endpoint without requiring any action from a logged-in user or administrator.

• Attack complexityDetail

  Exploitation is reliable and condition-free - no race conditions, memory layout knowledge, or special environmental factors are required to trigger code execution.

Blast Radius

• An attacker can execute arbitrary code under the identity of the flatnotes process, giving full control over the running container or host.
• All notes, attachments, and any secrets (API keys, credentials) readable by the process are exposed to the attacker.
• The attacker can overwrite or delete stored notes and uploaded files, corrupting or destroying persisted data.
• The service can be crashed or hijacked, causing a complete availability loss for all users of the flatnotes instance.