CVE-2026-64677 in Anki
Summary
by MITRE • 08/07/2026
Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read local files through directory traversal. This issue is fixed in version 25.09.3.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability in Anki's local HTTP server represents a critical directory traversal flaw that enables unauthorized access to local system files through improperly validated path requests. This security weakness affects versions prior to 25.09.3 and stems from insufficient input validation within the application's media and built-in data endpoints. The vulnerability occurs when the local HTTP server processes requests for media files or internal resources without adequate sanitization of user-supplied paths, creating opportunities for attackers to manipulate file access patterns through directory traversal sequences.
The technical implementation of this flaw allows malicious actors to exploit the lack of proper path validation by crafting specially formatted requests that traverse directory structures beyond the intended scope. When scripts are served from shared decks or when combined with malicious websites, attackers can leverage this vulnerability to read arbitrary local files on the victim's system. The issue specifically impacts the local HTTP server functionality that serves media content and built-in application data, making it particularly dangerous in environments where users might encounter untrusted shared decks or web content.
This vulnerability creates significant operational risks for Anki users since it enables potential information disclosure attacks that could expose sensitive local data including user preferences, database files, or other system resources. The attack vector combines elements of web-based exploitation with local file system access, making it particularly challenging to defend against through traditional network security measures alone. The combination of shared deck content and malicious websites creates a multi-layered threat scenario where users might unknowingly trigger the vulnerability when reviewing content from untrusted sources.
The fix implemented in version 25.09.3 addresses this issue through enhanced path validation mechanisms that properly constrain file access requests to only allow access within designated directories. This remediation aligns with established security practices for preventing directory traversal attacks and follows principles outlined in CWE-22 which specifically addresses improper limitation of a pathname to a restricted directory. Organizations should prioritize updating to version 25.09.3 or later to mitigate this vulnerability, as the fix ensures that all media and built-in data endpoints properly validate and sanitize user-supplied paths before processing file access requests. The implementation likely includes input filtering, path normalization, and strict directory boundary enforcement to prevent unauthorized traversal operations.
From a threat modeling perspective, this vulnerability maps to several ATT&CK techniques including T1059 for command and scripting interpreter usage and T1074 for data staging through local system access. The attack chain typically involves initial compromise through shared content or malicious websites followed by exploitation of the directory traversal flaw to gain unauthorized file access. Security teams should monitor for potential exploitation attempts in network logs and implement appropriate access controls around shared deck environments while ensuring users maintain current versions of the application to prevent successful exploitation of this vulnerability.