CVE-2026-118693
Medium · 4.7CVSS
4.7
EPSS
0.1%
Published
Oct 28, 2026
CISA due date
—
The record
CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_create_image_from_xml that trusts unvalidated embedded-file 'filename' attributes in XML documents. Attackers can craft a .ctd, .ctz, or .ctx document with an absolute or ~/ filename and no data, so saving embeds files like ~/.ssh/id_rsa into the document.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-83784 Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized… CWE-36
- CVE-2026-83683 Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized… CWE-36
- CVE-2026-89009 WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an… CWE-36
- CVE-2026-68487 Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an… CWE-36
- CVE-2026-88288 GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi… CWE-36
- CVE-2026-47606 NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could… CWE-36
- CVE-2026-46345 compliance-trestle is a tooling platform for managing compliance as code. CWE-36
- CVE-2026-47243 Kata Containers is an open source project focusing on a standard implementation of… CWE-36