Live › vulnerability › CVE-2026-118693
Go to dashboardCherryTree 1.7.2 and earlier trusts the filename attribute of embedded files in .ctd, .ctz and .ctx documents, including absolute and ~/ paths. A crafted document makes saving pull files such as ~/.ssh/id_rsa into the document, so the person who opens it can read those files.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 22:35 UTC. All times on this page are UTC.
Anyone who opens and saves CherryTree documents received from outside their team can be affected, because the flaw is in how the document's embedded files are read on save. Teams that only use their own documents, or run a version later than 1.7.2 if the sources confirm a fix, can skip it.
No product ranges from the sources yet.
1.7.2; the sources say versions through 1.7.2 are affected.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_create_image_from_xml that trusts unvalidated embedded-file 'filename' attributes in XML documents. Attackers can craft a .ctd, .ctz, or .ctx document with an absolute or ~/ filename and no data, so saving embeds files like ~/.ssh/id_rsa into the document.
This page as .md · .json · in your agent: get_signal("CVE-2026-118693")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.