UBUNTU-CVE-2026-118692: High severity vulnerability
CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::linkclicked that allows attackers to execute commands by embedding shell metacharacters in web link URLs. When the non-default Custom Web Link Clicked Action option is enabled, attackers can supply crafted documents whose links pass $(...), backticks, or semicolons unquoted to std::system, running commands as the victim on click.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the non-default Custom Web Link Clicked Action option to prevent web link URLs from being passed to std::system unquoted.
CherryTree Custom Web Link Clicked Action = disabled
Event History
Frequently Asked Questions
Which users are exposed to this issue?
Users are exposed only when the non-default Custom Web Link Clicked Action option is enabled. Exploitation also requires the user to open an attacker-crafted document and click its malicious web link.
What does an attacker need to include in a malicious link?
The crafted web link URL must contain shell metacharacters that reach the custom action unquoted, such as $(...), backticks, or semicolons. This can cause commands to run with the privileges of the user who clicks the link.
What can be done while a fix is unavailable?
Disable the Custom Web Link Clicked Action option and avoid opening or clicking web links in untrusted documents. The described vulnerable path depends on that non-default option being enabled.