Skip to content
OpenAdvisories

Package · Debian

cherrytree

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 4.7
    CVE-2026-118693

    CherryTree through 1.7.2 Local File Disclosure via Embedded-File Filename Path

    CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_create_image_from_xml that trusts unvalidated embedded-file 'filename' attributes in XML documents. Attackers can craft a .ctd, .ctz, or .ctx document with an absolute or…

    giuspen cherrytree cherrytree cherrytree Debian Ubuntu
  • High 7.0
    CVE-2026-118692

    CherryTree through 1.7.2 OS Command Injection via Custom Web Link Action

    CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked that allows attackers to execute commands by embedding shell metacharacters in web link URLs. When the non-default Custom Web Link Clicked Action option is enab…

    giuspen cherrytree cherrytree cherrytree Debian Ubuntu