CVE-2026-111915

Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files via the path or doc parameter of /api/help. Attackers can supply repeated '../' segments, which bypass the single-replacement sanitization in the publicly allowlist...

CVE-2026-111915 Yank Note before 3.93.1 Path Traversal via /api/help Endpoint

Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files via the path or doc parameter of /api/help. Attackers can supply repeated '../' segments, which bypass the single-replacement sanitization in the publicly allowlist...

EUVD-2026-104318

Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files via the path or doc parameter of /api/help. Attackers can supply repeated '../' segments, which bypass the single-replacement sanitization in the publicly allowlist...

CVE-2026-111915

Versions of Yank Note prior to 3.93.1 are vulnerable to a path traversal vulnerability (CWE-22) via the /api/help endpoint. Unauthenticated remote attackers can bypass single-replacement sanitization by supplying repeated ../ segments in the path or doc parameters. This flaw allows attackers to r...