https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 10 Nov 2026 07:43:34 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-118693 <p>CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_create_image_from_xml that trusts unvalidated embedded-file &#39;filename&#39; attributes in XML documents. Attackers can craft a .ctd, .ctz, or .ctx document with an absolute or ~/ filename and no data, so saving embeds files like ~/.ssh/id_rsa into the document.</p> <p>CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_create_image_from_xml that trusts unvalidated embedded-file &#39;filename&#39; attributes in XML documents. Attackers can craft a .ctd, .ctz, or .ctx document with an absolute or ~/ filename and no data, so saving embeds files like ~/.ssh/id_rsa into the document.</p> https://db.gcve.eu/vuln/fkie_cve-2026-118693 https://db.gcve.eu/vuln/ghsa-237p-f2v6-hfc2 <p>CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_create_image_from_xml that trusts unvalidated embedded-file &#39;filename&#39; attributes in XML documents. Attackers can craft a .ctd, .ctz, or .ctx document with an absolute or ~/ filename and no data, so saving embeds files like ~/.ssh/id_rsa into the document.</p> <p>CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_create_image_from_xml that trusts unvalidated embedded-file &#39;filename&#39; attributes in XML documents. Attackers can craft a .ctd, .ctz, or .ctx document with an absolute or ~/ filename and no data, so saving embeds files like ~/.ssh/id_rsa into the document.</p> https://db.gcve.eu/vuln/ghsa-237p-f2v6-hfc2 https://db.gcve.eu/vuln/ubuntu-cve-2026-118693 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: cherrytree, Ubuntu:18.04:LTS: cherrytree, Ubuntu:22.04:LTS: cherrytree, Ubuntu:24.04:LTS: cherrytree, Ubuntu:26.10: cherrytree, Ubuntu:26.04:LTS: cherrytree</p> <p>CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_create_image_from_xml that trusts unvalidated embedded-file &#39;filename&#39; attributes in XML documents. Attackers can craft a .ctd, .ctz, or .ctx document with an absolute or ~/ filename and no data, so saving embeds files like ~/.ssh/id_rsa into the document.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: cherrytree, Ubuntu:18.04:LTS: cherrytree, Ubuntu:22.04:LTS: cherrytree, Ubuntu:24.04:LTS: cherrytree, Ubuntu:26.10: cherrytree, Ubuntu:26.04:LTS: cherrytree</p> <p>CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_create_image_from_xml that trusts unvalidated embedded-file &#39;filename&#39; attributes in XML documents. Attackers can craft a .ctd, .ctz, or .ctx document with an absolute or ~/ filename and no data, so saving embeds files like ~/.ssh/id_rsa into the document.</p> https://db.gcve.eu/vuln/ubuntu-cve-2026-118693