CVE-2026-64677

EUVD-2026-54206
Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read local files through directory traversal. This issue is fixed in version 25.09.3.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
GitHub_MCNA
5.9 MEDIUM
NETWORK
LOW
NONE
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 51.7%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
ankitectsanki
25.9.3 ≤
CNA
Debian logo
Debian Releases
Debian Product
Codename
anki
bullseye
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
anki
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
dne
Common Weakness Enumeration
References
https://github.com/ankitects/anki/commit/f4692e54a4fafc89528afab1983f0b98d593023f
https://github.com/ankitects/anki/security/advisories/GHSA-78wr-2gg2-4hqg