CVE-2026-118693: CherryTree through 1.7.2 Local File Disclosure via Embedded-File Filename Path
CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::createimagefromxml that trusts unvalidated embedded-file 'filename' attributes in XML documents. Attackers can craft a .ctd, .ctz, or .ctx document with an absolute or ~/ filename and no data, so saving embeds files like ~/.ssh/idrsa into the document.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
An attacker must craft a malicious .ctd, .ctz, or .ctx document containing an embedded-file filename attribute with an absolute path or a ~/ path and no data. A user must then interact with the document and save it.
Who is exposed to file disclosure?
Users who open and save attacker-controlled CherryTree documents are exposed. The disclosed file is read from the filesystem accessible to the user running CherryTree, such as ~/.ssh/id_rsa.
How can I tell whether a document is malicious?
Inspect embedded-file filename attributes in the document XML for absolute paths or paths beginning with ~/. A filename with no associated data is part of the described exploit condition.