CVE-2026-35593 — Remote Code Execution

title: CVE-2026-35593 - Trilium Notes LFI to Arbitrary File Read
id: scw-2026-05-20-ai-1
status: experimental
level: high
description: |
  Detects the specific POST request pattern to '/api/attachments/{attachmentId}/upload-modified-file' used in CVE-2026-35593. The presence of sensitive file paths in the request body (filePath parameter) indicates an attempt to exploit the Local File Inclusion vulnerability to read arbitrary files from the server, such as SSH keys, credentials, or OS configuration files.
author: SCW Feed Engine (AI-generated)
date: 2026-05-20
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-35593/
tags:
  - attack.discovery
  - attack.t1083
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/api/attachments/'
      cs-method:
          - 'POST'
      cs-uri|endswith:
          - '/upload-modified-file'
  selection_body:
      filePath|contains:
          - '/etc/passwd'
          - '/etc/shadow'
          - '/root/.ssh/id_rsa'
          - '/etc/hosts'
          - 'C:\Windows\System32\drivers\etc\hosts'
          - 'C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt'
      condition: selection AND selection_body
  condition: selection AND selection_body
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse