CVE-2026-64677mediumCWE-22

CVE-2026-64677: falha de média gravidade em ankitects anki

Anki's local HTTP server is vulnerable to directory traversal attacks

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Anki

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.9epss 1.0%
Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read local files through directory traversal. This issue is fixed in version 25.09.3.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
ankitects · anki
CVEs relacionadas — ankitects anki

No mesmo produto, das mais perigosas para as menos.

CVE-2026-59153LOWAnki's local HTTP server does not sufficiently validate requestsEPSS 0.3%CVE-2026-58266MEDIUMAnki: User scripts in iframes have access to the internal Anki APIEPSS 0.2%