Path Traversal Vulnerability in Yank Note by Purocean

CVE-2026-111915

What is CVE-2026-111915?

Yank Note versions prior to 3.93.1 are susceptible to a path traversal vulnerability that allows unauthenticated remote attackers to exploit the /api/help endpoint. By manipulating the path or doc parameters with repeated '../' sequences, attackers can bypass the sanitation measures and gain unauthorized access to sensitive files, including SSH keys and configuration files. It is crucial for users to upgrade to version 3.93.1 or later to mitigate this security risk effectively.

References