CVE-2026-118693Medium· 4.7▾ SunlitCherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_create_image_from_xml that trusts unvalidated embedded-file 'filename' attributes in XML documents. Attackers can craft a .ctd, .ctz, or .ctx docume…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 25.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.1%
CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_create_image_from_xml that trusts unvalidated embedded-file 'filename' attributes in XML documents. Attackers can craft a .ctd, .ctz, or .ctx document with an absolute or ~/ filename and no data, so saving embeds files like ~/.ssh/id_rsa into the document.
cherrytree <= 1.7.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-118692High· 7.0CherryTree through 1.7.2 OS Command Injection via Custom Web Link Action
CVE-2026-83784High· 8.8Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges over a network.
CVE-2026-83746High· 8.1Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.
CVE-2026-83683Medium· 6.5Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information over a network.
CVE-2026-70297High· 8.8Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to execute code over a network.
CVE-2026-0846High· 7.5nltk: NLTK: Arbitrary file read via improper path validation in `filestring()` function (CVE-2026-0846)