CVE-2026-118693 in CherryTree
Summary
by MITRE • 10/29/2026
CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_create_image_from_xml that trusts unvalidated embedded-file 'filename' attributes in XML documents. Attackers can craft a .ctd, .ctz, or .ctx document with an absolute or ~/ filename and no data, so saving embeds files like ~/.ssh/id_rsa into the document.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified in CherryTree versions through 1.7.2 represents a critical path traversal flaw within the CtStorageXmlHelper::_create_image_from_xml function. This component is responsible for processing embedded file references found within XML-based documents, specifically those with extensions such as .ctd, .ctz, or .ctx. The core technical failure lies in the application's trust of unvalidated input derived from filename attributes embedded directly inside these XML structures. When a user opens a maliciously crafted document containing an absolute path or a tilde-prefixed relative path like ~/id_rsa within an image tag, the software fails to sanitize this input before attempting to write data associated with that file reference. This lack of validation allows the application to interpret arbitrary filesystem locations as valid targets for embedding operations, bypassing intended directory boundaries and security controls designed to keep user-generated content isolated within specific directories.
From a technical perspective, this flaw enables an attacker to perform unauthorized writes to sensitive areas of the local operating system's file hierarchy. By crafting a CherryTree document that specifies a target path such as ~/.ssh/id_rsa with empty or minimal data payload, the application will overwrite or create files in critical system locations without raising any warnings or requiring elevated privileges beyond those held by the currently logged-in user. This behavior is particularly dangerous because it leverages the trust relationship between the user and their own documents to execute actions that compromise host integrity. The vulnerability aligns with CWE-22, which defines Improper Limitation of a Pathname to a Restricted Directory, as the application fails to restrict file operations to an expected sandbox or working directory. Furthermore, this technique can be classified under ATT&CK T1564.008, Hidden Files and Directories, if used to conceal malicious artifacts, or more broadly under data exfiltration vectors where sensitive keys are extracted from the compromised system via subsequent document sharing.
The operational impact of this vulnerability is severe, primarily due to its potential for privilege escalation through credential theft. If an attacker successfully tricks a user into opening a crafted CherryTree file, they can overwrite SSH private keys located in the .ssh directory. This action not only destroys legitimate access credentials but also allows the attacker to replace them with their own key pair if they control the content being written, or simply corrupt existing keys to cause denial of service for remote authentication services. Additionally, overwriting other sensitive configuration files could lead to further system compromise, such as modifying cron jobs, shell profiles, or application configurations that execute code upon user login or specific triggers. The ability to write arbitrary data to absolute paths means the scope of impact extends beyond simple document corruption to full host-level manipulation, potentially leading to persistent access if combined with other exploitation techniques like web shells or backdoors placed in writable directories accessible by the service account running CherryTree.
Mitigation strategies for this vulnerability require both immediate patching and long-term architectural improvements. Users should immediately upgrade to a version of CherryTree later than 1.7.2, where developers have implemented proper input validation and path canonicalization checks within the image embedding logic. Until an update is applied, administrators can mitigate risk by restricting file permissions on sensitive directories like ~/.ssh to prevent write access from applications that do not require it, although this may impact legitimate functionality. From a development standpoint, the fix must enforce strict allow-listing of permitted characters in filenames and ensure all paths are resolved against a predefined base directory before any filesystem operations occur. Implementing sandboxed execution environments for parsing untrusted XML documents would also reduce the blast radius of such input validation failures. Security awareness training is equally important, as users should be advised to exercise caution when opening CherryTree files from unknown or untrusted sources, recognizing that even document formats perceived as safe can contain executable logic or destructive file operations if not properly validated by the host application.