cherrytree vulnerabilities
CVEs whose affected-version data names the cherrytree package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-118693Medium· 4.7CherryTree through 1.7.2 Local File Disclosure via Embedded-File Filename Path
CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_create_image_from_xml that trusts unvalidated embedded-file 'filename' attributes in XML documents. Attackers can craft a .ctd, .ctz, or .ctx docume…
▾ Sunlitgiuspen · cherrytreeEPSS 0.14%via CVEORG
CVE-2026-118692High· 7.0CherryTree through 1.7.2 OS Command Injection via Custom Web Link Action
CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked that allows attackers to execute commands by embedding shell metacharacters in web link URLs. When the non-default Custom Web Link Clicked…
▾ Twilightgiuspen · cherrytreeEPSS 0.58%via CVEORG