CVE-2026-118693

MediumCVSS 4.7/10Last modified Nov 3, 2026

Description

CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_create_image_from_xml that trusts unvalidated embedded-file 'filename' attributes in XML documents. Attackers can craft a .ctd, .ctz, or .ctx document with an absolute or ~/ filename and no data, so saving embeds files like ~/.ssh/id_rsa into the document.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-36

Affected software

Vendor	Product	Versions
giuspen	cherrytree	<= 1.7.2

References

Timeline

Published: Oct 28, 2026
Last modified: Nov 3, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1186947.5python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote users to exhaust CPU by submitting Markdown wit CVE-2026-1186968.0In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026 CVE-2026-1186979.0In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand and Rider before 2026.3 and 20 CVE-2026-1186986.5The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'pgro CVE-2026-11876.4The ZoomifyWP Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'filename' parameter of the 'zoomify' shortcode CVE-2026-118705.4The WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05 does not verify that client IP information comes from a trusted proxy before CVE-2026-1187008.8Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1187018.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1187028.8Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1187038.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1187048.8Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1187058.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.