Dear Maintainer,

Two vulnerabilities affect cherrytree, both fixed upstream on 2026-10-31 in
commit 0a0638651:

- CVE-2026-118692: OS command injection in CtActions::link_clicked
(src/ct/ct_actions_others.cc). With the custom web-link action enabled
(weblink_custom_on), a note's link URL is substituted into a shell command
string and run via std::system with no escaping, so a crafted URL inside a
shared, synced, or imported document executes arbitrary commands as the
user when the link is clicked.
- CVE-2026-118693: path traversal / local file disclosure in
CtStorageXmlHelper::_create_image_from_xml, which trusts an unvalidated
embedded-file "filename" when a document is opened.

Affected: upstream through 1.7.2, including the version currently in
Debian/Kali (1.2.0+dfsg-1+b2).
Fixed: upstream master, commit 0a0638651. No fixed upstream release has
been tagged yet at the time of filing; a release above v1.7.2 is expected
to carry the fix. Please update the package once a fixed upstream release
is available, or backport commit 0a0638651.

References:
https://www.cve.org/CVERecord?id=CVE-2026-118692
https://www.cve.org/CVERecord?id=CVE-2026-118693
https://github.com/giuspen/cherrytree/commit/0a0638651
https://r3vpwnx.space/research/cherrytree-weblink-cmdinjection/

Thanks,
Dilanka Kaushal Hewage (r3vpwnx)