CVE-2026-118693— CherryTree through 1.7.2 Local File Disclosure via Embedded-File Filename Path
Quick assessment
Affected
giuspen cherrytree
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
CherryTree 1.7.2 及更早版本存在路径遍历漏洞。该漏洞位于 函数中，该函数会信任 XML 文档中嵌入文件的未经验证的 属性。攻击者可构造包含绝对路径或 路径且无实际数据的 、 或 文档，从而在保存时将诸如 等敏感文件嵌入到文档中。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-118693
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
CherryTree through 1.7.2 Local File Disclosure via Embedded-File Filename Path
Source: CVE Program / CVE List V5
Vulnerability Description
CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_create_image_from_xml that trusts unvalidated embedded-file 'filename' attributes in XML documents. Attackers can craft a .ctd, .ctz, or .ctx document with an absolute or ~/ filename and no data, so saving embeds files like ~/.ssh/id_rsa into the document.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
绝对路径遍历
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| giuspen | cherrytree | 0 ~ 1.7.2 | - |
|
II. Public POCs for CVE-2026-118693
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-118693
请登录查看更多情报信息。
Other References for CVE-2026-118693 (5)
-
https://github.com/giuspen/cherrytree/blob/v1.7.2/src/ct/ct_image.cc#L757-L767 technical-description
-
https://github.com/giuspen/cherrytree/blob/v1.7.2/src/ct/ct_storage_xml.cc#L648-L692 technical-description
-
https://github.com/giuspen/cherrytree/issues/2944 issue-tracking
IV. Related Vulnerabilities
Same weakness: CWE-36
-
CVE-2026-70297
Skype for Business Remote Code Execution Vulnerability -
CVE-2026-83746
Skype for Business Elevation of Privilege Vulnerability -
CVE-2026-83683
Windows Encrypting File System (EFS) Information Disclosure -
CVE-2026-83784
Windows Encrypting File System (EFS) Elevation of Privilege -
CVE-2025-70820
Zettlab D6 Ultra 路径遍历漏洞