Yank Note CVE-2026-111915

Concrete prerequisites: the attacker must be able to reach Yank Note's embedded HTTP server and hit the /api/help endpoint, which is publicly allowlisted and therefore requires no authentication (PR:N). The decisive limiting factor is network exposure - Yank Note's server is designed to listen locally, so remote exploitation requires the instance to be bound to a non-localhost interface or otherwise reachable (this gating is reflected by AT:P/AC:H and is the likely reason the vector is not a straight AV:N/AC:L/PR:N/UI:N). The exploit itself requires supplying repeated '../' segments in the doc or path parameter to defeat the single-replacement sanitizer; impact is limited to file disclosure (confidentiality only - no write/integrity or availability effect). Affected versions are Yank Note before 3.93.1.

Signals point to a genuine but exposure-gated issue rather than a drop-everything emergency. The official CVSS:4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:H) scores 8.2 (High): network-reachable, unauthenticated, confidentiality-only impact with no integrity or availability effect. The AC:H and AT:P metrics are notable - they indicate the attack is not trivially universal, which fits Yank Note's architecture: its embedded HTTP server typically listens on localhost by default, so remote exploitation realistically requires the instance to be deliberately exposed on a network interface or reachable via a sharing/port-forward configuration (this exposure requirement is INFERRED from the AT:P/AC:H metrics and product design, not explicitly stated in the description). Against an exposed instance the flaw itself is simple - the description shows a single-replacement sanitizer that repeated '../' segments defeat, which is low-complexity once reachable; the AC:H/AT:P therefore appear to encode the deployment precondition rather than exploit difficulty. There is no CISA KEV listing and no public exploit code referenced in the input, so exploitation is not confirmed active; the disclosure comes from VulnCheck research with a vendor patch already available. No EPSS score was provided. Net: patch promptly where Yank Note is network-exposed (high priority), but internet-wide mass exploitation is unlikely given the localhost-default design and niche footprint.

An attacker who can reach a network-exposed Yank Note instance sends an HTTP request to the publicly allowlisted /api/help endpoint with a doc or path parameter containing repeated '../' segments. Because the endpoint's sanitization only strips one traversal sequence, the nested sequences survive and resolve outside the help directory, letting the unauthenticated attacker read arbitrary files such as SSH private keys, configuration, or the user's notes. No public exploit code was identified in the provided data.