Description
Improper path handling in Obsidian desktop before 1.2.8 on Windows, Linux and macOS allows a crafted webpage to access local files and exfiltrate them to remote web servers via "app://local/<absolute-path>". This vulnerability can be exploited if a user opens a malicious markdown file in Obsidian, or copies text from a malicious webpage and paste it into Obsidian.
References (2)
Core 2
Core References
Release Notes release-notes
https://obsidian.md/changelog/2023-05-03-desktop-v1.2.8/
Exploit, Mitigation, Third Party Advisory third-party-advisory
https://starlabs.sg/advisories/23/23-2110/
Scores
CVSS v3
8.2
EPSS
0.0033
EPSS Percentile
25.0%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
total
Details
CWE
CWE-22
Status
published
Products (1)
obsidian/obsidian
< 1.2.8
Published
Aug 19, 2023
Tracked Since
Feb 18, 2026