CVE-2026-118693
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
36/100
Published: 2026-10-28
Modified: 2026-10-28
First seen: 2026-10-29
Status: active
Attack Surface
Low Complexity
No Auth
Conf. Impact
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
None
UI:
Active
AT:
Present
VC:
High
VI:
None
VA:
None
Description
CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_create_image_from_xml that trusts unvalidated embedded-file 'filename' attributes in XML documents. Attackers can craft a .ctd, .ctz, or .ctx document with an absolute or ~/ filename and no data, so saving embeds files like ~/.ssh/id_rsa into the document.
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| giuspen | cherrytree | 0 |
| giuspen | cherrytree | 0 |