CVE-2026-118693
CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_create_image_from_xml that trusts unvalidated embed
CVSS
4.7
Medium
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Oct 28, 2026 · Last modified: Oct 28, 2026 · CWE-36
Not enough EPSS history yet.
CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_create_image_from_xml that trusts unvalidated embedded-file 'filename' attributes in XML documents. Attackers can craft a .ctd, .ctz, or .ctx document with an absolute or ~/ filename and no data, so saving embeds files like ~/.ssh/id_rsa into the document.
- github.comhttps://github.com/giuspen/cherrytree
- github.comhttps://github.com/giuspen/cherrytree/blob/v1.7.2/src/ct/ct_image.cc#L757-L767
- github.comhttps://github.com/giuspen/cherrytree/blob/v1.7.2/src/ct/ct_storage_xml.cc#L648-L692
- github.comhttps://github.com/giuspen/cherrytree/issues/2944
- www.vulncheck.comhttps://www.vulncheck.com/advisories/cherrytree-through-1.7.2-local-file-disclosure-via-embedded-file-filename-path
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-837848.8 HIG64.9%
——19Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges over a network.12dCVE-2026-837468.1 HIG66.6%
——20Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.15dCVE-2026-836836.5 MED70.0%
——21Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information over a network.12dCVE-2026-702978.8 HIG67.0%
——20Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to execute code over a network.15dCVE-2026-55062—5.6%
——2uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with the selected hooks directory, allowing parent-directory components to escape that directory. The resulting path is passed to the configured editor, which can access or modify files outside the hooks directory with the privileges of the uniget process account. This issue is fixed in version 0.27.6.35dCVE-2025-708203.5 LOW19.0%
——6Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders other than the personal folder.14d