UBUNTU-CVE-2026-118693: Path Traversal

Published Oct 29, 2026

Updated

CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::createimagefromxml that trusts unvalidated embedded-file 'filename' attributes in XML documents. Attackers can craft a .ctd, .ctz, or .ctx document with an absolute or ~/ filename and no data, so saving embeds files like ~/.ssh/idrsa into the document.

Affected Software

6 affected components

ubuntu/cherrytree*

Event History

Oct 29, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Users of CherryTree through 1.7.2 who open an attacker-crafted .ctd, .ctz, or .ctx document and save it are exposed. The attacker does not need prior privileges, but user interaction is required.

What does an attacker need to include in a malicious document?

The document must contain an embedded-file filename attribute using an absolute path or a ~/ path, with no embedded data. When the document is saved, CherryTree can include the referenced local file in the saved document.

What files could be disclosed?

Files readable by the user running CherryTree may be embedded, including sensitive files such as ~/.ssh/id_rsa. The available information does not indicate any integrity or availability impact.

UBUNTU-CVE-2026-118693: Path Traversal

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to include in a malicious document?

What files could be disclosed?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to include in a malicious document?

What files could be disclosed?