CVE-2026-118693

Received Received - Intake

Path Traversal in CherryTree XML Import

Publication date: 2026-10-28

Last updated on: 2026-10-28

Assigner: VulnCheck

Description

CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_create_image_from_xml that trusts unvalidated embedded-file 'filename' attributes in XML documents. Attackers can craft a .ctd, .ctz, or .ctx document with an absolute or ~/ filename and no data, so saving embeds files like ~/.ssh/id_rsa into the document.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-28

Last Modified

2026-10-28

Generated

2026-10-29

AI Q&A

2026-10-29

EPSS Evaluated

N/A

NVD

CVE-2026-118693

EUVD

EUVD-2026-112494

Affected Vendors & Products

Vendor	Product	Version / Range
giuspen	cherrytree	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-36	The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.

Attack-Flow Graph

Executive Summary

CherryTree through 1.7.2 has a path traversal flaw in the function CtStorageXmlHelper::_create_image_from_xml. It improperly handles unvalidated 'filename' attributes in embedded XML files, allowing attackers to insert absolute or home directory paths (e.g., ~/.ssh/id_rsa) into documents like .ctd, .ctz, or .ctx without any file data.

Impact Analysis

An attacker could trick a user into opening a malicious CherryTree document, which may overwrite sensitive files like SSH keys or configuration files in the user's home directory. This could lead to unauthorized access or system compromise if critical files are overwritten.

Mitigation Strategies

Update CherryTree to the latest version beyond 1.7.2 to patch the path traversal vulnerability. Avoid opening untrusted .ctd, .ctz, or .ctx files from unknown sources. Review XML files for suspicious embedded file paths referencing sensitive locations like ~/.ssh/id_rsa.

Hi! I’m here to help you understand CVE-2026-118693. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70