CVE-2026-111915: Yank Note before 3.93.1 Path Traversal via /api/help Endpoint

Q: Which deployments are exposed?

Yank Note versions before 3.93.1 are affected when the publicly allowlisted /api/help endpoint is reachable by an attacker. No authentication is required.

Q: What does an attacker need to exploit this issue?

An attacker only needs network access to the /api/help endpoint and can use the path or doc parameter. Exploitation requires crafting repeated ../ path segments to bypass the endpoint's single-replacement sanitization.

Q: What information could be exposed?

The flaw permits reading arbitrary files accessible to the Yank Note process. The reported examples include SSH keys, configuration files, and notes.

Q: How can I determine whether my instance is affected?

Instances running a Yank Note release earlier than 3.93.1 should be treated as affected. The vulnerable behavior is associated with /api/help accepting traversal sequences through its path or doc parameter.

Published Oct 19, 2026

Updated

Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files via the path or doc parameter of /api/help. Attackers can supply repeated '../' segments, which bypass the single-replacement sanitization in the publicly allowlisted endpoint, to read SSH keys, configuration, or notes.

Affected Software

1 affected component

Yank Note Yank Note<3.93.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Yank Note to a version that resolves this vulnerability.
Fixed in 3.93.1

Event History

Oct 19, 2026

CVE Published

via MITRE·01:55 PM

Data Sourced

via MITRE·01:55 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Yank Note versions before 3.93.1 are affected when the publicly allowlisted /api/help endpoint is reachable by an attacker. No authentication is required.

What does an attacker need to exploit this issue?

An attacker only needs network access to the /api/help endpoint and can use the path or doc parameter. Exploitation requires crafting repeated ../ path segments to bypass the endpoint's single-replacement sanitization.

What information could be exposed?

The flaw permits reading arbitrary files accessible to the Yank Note process. The reported examples include SSH keys, configuration files, and notes.

How can I determine whether my instance is affected?

Instances running a Yank Note release earlier than 3.93.1 should be treated as affected. The vulnerable behavior is associated with /api/help accepting traversal sequences through its path or doc parameter.

CVE-2026-111915: Yank Note before 3.93.1 Path Traversal via /api/help Endpoint

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What information could be exposed?

How can I determine whether my instance is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What information could be exposed?

How can I determine whether my instance is affected?