CVE-2026-118692: CherryTree through 1.7.2 OS Command Injection via Custom Web Link Action
CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::linkclicked that allows attackers to execute commands by embedding shell metacharacters in web link URLs. When the non-default Custom Web Link Clicked Action option is enabled, attackers can supply crafted documents whose links pass $(...), backticks, or semicolons unquoted to std::system, running commands as the victim on click.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of CherryTree through 1.7.2 are exposed when they have enabled the non-default Custom Web Link Clicked Action option and open a crafted document containing a malicious web link. The command runs with the privileges of the user who clicks the link.
What must an attacker do to trigger exploitation?
An attacker needs to provide a crafted document with a web link URL containing shell metacharacters such as $(...), backticks, or semicolons. The victim must open the document and click the malicious link while the Custom Web Link Clicked Action option is enabled.
Are default CherryTree installations affected?
The vulnerable behavior requires the non-default Custom Web Link Clicked Action option to be enabled. The provided information does not indicate that the default web-link handling configuration invokes the affected command path.
What can be done if updating is not immediately possible?
Disable the Custom Web Link Clicked Action option and avoid clicking web links in untrusted CherryTree documents. Treat documents received from untrusted sources as potentially malicious until the option is disabled or a remediation is available.