CVE-2026-118693

EUVD-2026-112494
CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_create_image_from_xml that trusts unvalidated embedded-file 'filename' attributes in XML documents. Attackers can craft a .ctd, .ctz, or .ctx document with an absolute or ~/ filename and no data, so saving embeds files like ~/.ssh/id_rsa into the document.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.7 MEDIUM
LOCAL
HIGH
NONE
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/giuspen/cherrytree
https://github.com/giuspen/cherrytree/blob/v1.7.2/src/ct/ct_image.cc#L757-L767
https://github.com/giuspen/cherrytree/blob/v1.7.2/src/ct/ct_storage_xml.cc#L648-L692
https://github.com/giuspen/cherrytree/issues/2944
https://www.vulncheck.com/advisories/cherrytree-through-1.7.2-local-file-disclosure-via-embedded-file-filename-path