EUVD-2026-112494

CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::createimagefromxml that trusts unvalidated embedded-file 'filename' attributes in XML documents. Attackers can craft a .ctd, .ctz, or .ctx document with an absolute or / filename and no data, so saving embeds...

CVE-2026-118693

Versions of CherryTree up to and including 1.7.2 are vulnerable to a path traversal vulnerability within the CtStorageXmlHelper::_create_image_from_xml function. The root cause is the application's trust in unvalidated filename attributes within embedded-file tags in XML documents. An attacker ca...