CVE-2026-118692

Versions of CherryTree through 1.7.2 are vulnerable to an OS command injection in the CtActions::link_clicked function. If the non-default Custom Web Link Clicked Action option is enabled, an attacker can provide a crafted document containing URLs with unquoted shell metacharacters—such as $(...)...