CVE-2026-118692
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked that allows attackers to execute commands by embedding shell metacharacters in web link URLs. When the non-default Custom Web Link Clicked Action option is enabled, attackers can supply crafted documents whose links pass $(...), backticks, or semicolons unquoted to std::system, running commands as the victim on click.
Risk Assessment
Opening a crafted document and clicking a link can lead to arbitrary command execution with the victim's privileges, potentially resulting in system compromise.
Recommendation
Update CherryTree to a version later than 1.7.2 and avoid enabling the Custom Web Link Clicked Action option.
Other vulnerabilities in CherryTree
Original NVD description (English source)
CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked that allows attackers to execute commands by embedding shell metacharacters in web link URLs. When the non-default Custom Web Link Clicked Action option is enabled, attackers can supply crafted documents whose links pass $(...), backticks, or semicolons unquoted to std::system, running commands as the victim on click.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS