p PatchFirst

CVE-2026-118692

CVE-2026-118692 · CherryTree through 1.7.2 OS Command Injection via Custom Web Link Action

This page contains facts from public vulnerability sources. Check the original advisory before updating.

CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked that allows attackers to execute commands by embedding shell metacharacters in web link URLs. When the non-default Custom Web Link Clicked Action option is enabled, attackers can supply crafted documents whose links pass $(...), backticks, or semicolons unquoted to std::system, running commands as the victim on click.

CVSS 7.1 · High · EPSS 0.6%

Published
Updated

Stack: system

Affected products and versions

  • cherrytree

    Versions
    • ≥ 0, ≤ 1.7.2: Affected (custom)

    No fix published

  • cherrytree Ubuntu:16.04:LTS

    Versions
    • 0.35.10-1
    • 0.35.11-1
    • 0.36.2-1
    • 0.36.3-1
    • 0.36.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cherrytree Ubuntu:18.04:LTS

    Versions
    • 0.37.6-1
    • 0.37.6-1.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cherrytree Ubuntu:22.04:LTS

    Versions
    • 0.99.40+dfsg-1
    • 0.99.43+dfsg-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cherrytree Ubuntu:24.04:LTS

    Versions
    • 0.99.48+dfsg-1
    • 1.0.2+dfsg-1
    • 1.0.2+dfsg-1build2
    • 1.0.2+dfsg-1build3
    • 1.1.2+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cherrytree Ubuntu:26.10

    Versions
    • 1.2.0+dfsg-1build2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cherrytree Ubuntu:26.04:LTS

    Versions
    • 1.2.0+dfsg-1build1
    • 1.2.0+dfsg-1build2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →