Live › vulnerability › CVE-2026-111915
Go to dashboardYank Note before 3.93.1 has a path traversal flaw in its public /api/help endpoint, where the path or doc parameter is sanitized only once. An unauthenticated attacker sending repeated '../' segments can read arbitrary files, including SSH keys, configuration and notes.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Anyone running Yank Note before 3.93.1 where the server is reachable by a client that can send requests to /api/help, since that endpoint is publicly allowlisted and needs no login. Local-only desktop use with no network exposure is less exposed. unknown whether the sources list specific deployment modes beyond this.
No product ranges from the sources yet.
3.93.1 are affected./api/help with repeated ../ segments in the path or doc parameter from an unauthenticated client and see whether it returns files outside the help directory.3.93.1 or later./api/help and rotate any SSH keys or secrets stored on the host that may have been exposed.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files via the path or doc parameter of /api/help. Attackers can supply repeated '../' segments, which bypass the single-replacement sanitization in the publicly allowlisted endpoint, to read SSH keys, configuration, or notes.
This page as .md · .json · in your agent: get_signal("CVE-2026-111915")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.