OS Command Injection Vulnerability in CherryTree by Giuspen
CVE-2026-118692

7.1HIGH

Key Information:

Vendor

Giuspen

Status
Cherrytree
Vendor
CVE Published:
28 October 2026

What is CVE-2026-118692?

CherryTree versions up to 1.7.2 are susceptible to an OS command injection flaw in the CtActions::link_clicked function. This vulnerability allows attackers to execute arbitrary commands by injecting shell metacharacters into web link URLs. If the Custom Web Link Clicked Action is enabled, attackers can exploit this vulnerability by using crafted documents that contain unquoted parameters in the form of $(...), backticks, or semicolons, which are then processed by std::system. This can lead to the execution of commands with the victim's privileges upon clicking the malicious links.

Affected Version(s)

cherrytree 0 <= 1.7.2

References

https://github.com/giuspen/cherrytree/issues/2945
issue-tracking
https://github.com/giuspen/cherrytree
product
https://github.com/giuspen/cherrytree/blob/v1.7.2/src/ct/...
technical-description

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mohammed Afnaan Ahmed
.