CVE-2026-118692

HighCVSS 7.0/10Last modified Nov 3, 2026

Description

CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked that allows attackers to execute commands by embedding shell metacharacters in web link URLs. When the non-default Custom Web Link Clicked Action option is enabled, attackers can supply crafted documents whose links pass $(...), backticks, or semicolons unquoted to std::system, running commands as the victim on click.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
giuspen	cherrytree	<= 1.7.2

References

Timeline

Published: Oct 28, 2026
Last modified: Nov 3, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1186934.7CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_create_image_from_xml that trusts unvalidated embed CVE-2026-1186947.5python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote users to exhaust CPU by submitting Markdown wit CVE-2026-1186968.0In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026 CVE-2026-1186979.0In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand and Rider before 2026.3 and 20 CVE-2026-1186986.5The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'pgro CVE-2026-11876.4The ZoomifyWP Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'filename' parameter of the 'zoomify' shortcode CVE-2026-118705.4The WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05 does not verify that client IP information comes from a trusted proxy before CVE-2026-1187008.8Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1187018.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1187028.8Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1187038.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1187048.8Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.