CVE-2026-118693

MediumCVSS 4.7

Published: 28/10/2026(UTC)Updated: 29/10/2026(UTC)Translated: 28/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

3th percentile - higher than 3% of all known CVEs

Summary

CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_create_image_from_xml that trusts unvalidated embedded-file 'filename' attributes in XML documents. Attackers can craft a .ctd, .ctz, or .ctx document with an absolute or ~/ filename and no data, so saving embeds files like ~/.ssh/id_rsa into the document.

Risk Assessment

Opening and saving a crafted document can cause sensitive user files such as SSH keys to be embedded into the document. This can lead to leakage of private data if the document is later shared.

Recommendation

Upgrade CherryTree to a version newer than 1.7.2 when available. Exercise caution when opening and saving documents from untrusted sources.

Other vulnerabilities in CherryTree

CVE-2026-118692High
CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked that allows attackers to execute commands by embedding shell metacharacters in web link URLs. When the non-default Custom Web Link Clicked Action option is enabled, attackers can supply crafted documents whose links pass $(...), backticks, or semicolons unquoted to std::system, running commands as the victim on click.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS