CVE-2026-118692 Details
Description
CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked that allows attackers to execute commands by embedding shell metacharacters in web link URLs. When the non-default Custom Web Link Clicked Action option is enabled, attackers can supply crafted documents whose links pass $(...), backticks, or semicolons unquoted to std::system, running commands as the victim on click.
A command injection vulnerability has been identified in CherryTree versions through 1.7.2. The issue arises in the 'CtActions::link_clicked' function, where unquoted shell metacharacters in web link URLs can be passed to 'std::system', executing commands as the user. This vulnerability is triggered when the 'Custom Web Link Clicked Action' option is enabled, allowing attackers to exploit crafted documents with malicious links.
It is recommended to update to a version of CherryTree that addresses this vulnerability. As of now, the latest version is 1.7.2, which still contains the issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 28, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/giuspen/cherrytree/issues/2945 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/giuspen/cherrytree | [email protected] | ProductVendor |
| https://github.com/giuspen/cherrytree/blob/v1.7.2/src/ct/ct_actions_others.cc#L381-L388 | [email protected] | Source CodeVendor |
| https://github.com/giuspen/cherrytree/blob/v1.7.2/src/ct/ct_misc_utils.cc#L227-L247 | [email protected] | Source CodeVendor |
| https://github.com/giuspen/cherrytree/issues/2945 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/cherrytree-through-1.7.2-os-command-injection-via-custom-web-link-action | [email protected] | AdvisoryBundleVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| CherryTree | <= 1.7.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Oct 28, 2026 | New CVE Received | [email protected] |