CVE-2026-118692— CherryTree through 1.7.2 OS Command Injection via Custom Web Link Action

Quick assessment

Affected

giuspen cherrytree

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

CherryTree 1.7.2 及更早版本在函数中存在操作系统命令注入漏洞。当启用了非默认的“自定义网页链接点击操作”（Custom Web Link Clicked Action）选项时，攻击者可通过在网页链接 URL 中嵌入 Shell 元字符，诱导受害者在点击链接时执行任意命令。具体而言，攻击者可构造恶意文档，使其中的链接将、反引号（` ` ; std::system` 函数，从而以受害者身份执行系统命令。

CVSS 7.0 · High Updated Oct 29, 2026

Possible ATT&CK Techniques 2 AI

T1059 · Command and Scripting Interpreter T1203 · Exploitation for Client Execution

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

CherryTree through 1.7.2 OS Command Injection via Custom Web Link Action

Source: CVE Program / CVE List V5

Vulnerability Description

CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked that allows attackers to execute commands by embedding shell metacharacters in web link URLs. When the non-default Custom Web Link Clicked Action option is enabled, attackers can supply crafted documents whose links pass $(...), backticks, or semicolons unquoted to std::system, running commands as the victim on click.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
giuspen	cherrytree	0 ~ 1.7.2	-

II. Public POCs for CVE-2026-118692

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-118692

请登录查看更多情报信息。

Other References for CVE-2026-118692 (5)

https://github.com/giuspen/cherrytree/blob/v1.7.2/src/ct/ct_misc_utils.cc#L227-L247 technical-description
https://github.com/giuspen/cherrytree product
https://github.com/giuspen/cherrytree/blob/v1.7.2/src/ct/ct_actions_others.cc#L381-L388 technical-description
https://github.com/giuspen/cherrytree/issues/2945 issue-tracking
https://www.vulncheck.com/advisories/cherrytree-through-1.7.2-os-command-injection-via-custom-web-link-action third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-118692

IV. Related Vulnerabilities

Same product: cherrytree

CVE-2026-118693
CherryTree through 1.7.2 Local File Disclosure via Embedded-

Same vendor: giuspen

CVE-2026-118693
CherryTree through 1.7.2 Local File Disclosure via Embedded-

Same weakness: CWE-78