Medium severity · published Oct 28, 2026
CVE-2026-118693
CherryTree through 1.7.2 Local File Disclosure via Embedded-File Filename Path
New
4.7
CVSS
–
EPSS
No
On KEV
Description
CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_create_image_from_xml that trusts unvalidated embedded-file 'filename' attributes in XML documents. Attackers can craft a .ctd, .ctz, or .ctx document with an absolute or ~/ filename and no data, so saving embeds files like ~/.ssh/id_rsa into the document.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CH
cherrytree · giuspen
through 1.7.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-118693
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-118693
github.com
https://github.com/giuspen/cherrytree
github.com
https://github.com/giuspen/cherrytree/blob/v1.7.2/src/ct/ct_image.cc#L757-L767
github.com
https://github.com/giuspen/cherrytree/blob/v1.7.2/src/ct/ct_storage_xml.cc#L648-L692
github.com
https://github.com/giuspen/cherrytree/issues/2944
www.vulncheck.com
https://www.vulncheck.com/advisories/cherrytree-through-1.7.2-local-file-disclosure-via-embedded-file-filename-path
More from cherrytree
7.0
CVE-2026-118692
CherryTree through 1.7.2 OS Command Injection via Custom Web Link Action