Package: cherrytree Version: 1.2.0+dfsg-1+b2 Severity: grave Tags: security upstream X-Debbugs-Cc: [email protected]
Dear Maintainer, Two vulnerabilities affect cherrytree, both fixed upstream on 2026-10-31 in commit 0a0638651: - CVE-2026-118692: OS command injection in CtActions::link_clicked (src/ct/ct_actions_others.cc). With the custom web-link action enabled (weblink_custom_on), a note's link URL is substituted into a shell command string and run via std::system with no escaping, so a crafted URL inside a shared, synced, or imported document executes arbitrary commands as the user when the link is clicked. - CVE-2026-118693: path traversal / local file disclosure in CtStorageXmlHelper::_create_image_from_xml, which trusts an unvalidated embedded-file "filename" when a document is opened. Affected: upstream through 1.7.2, including the version currently in Debian/Kali (1.2.0+dfsg-1+b2). Fixed: upstream master, commit 0a0638651. No fixed upstream release has been tagged yet at the time of filing; a release above v1.7.2 is expected to carry the fix. Please update the package once a fixed upstream release is available, or backport commit 0a0638651. References: https://www.cve.org/CVERecord?id=CVE-2026-118692 https://www.cve.org/CVERecord?id=CVE-2026-118693 https://github.com/giuspen/cherrytree/commit/0a0638651 https://r3vpwnx.space/research/cherrytree-weblink-cmdinjection/ Thanks, Dilanka Kaushal Hewage (r3vpwnx)
