CherryTree CVE-2026-118692

Exploitation requires the non-default 'Custom Web Link Clicked Action' option to be enabled in CherryTree (<=1.7.2); with the default configuration the vulnerable std::system path is not reached. The attacker must get the victim to open an attacker-crafted document and then click a web link whose URL contains unquoted shell metacharacters ($(...), backticks, or semicolons). Limiting factors: the non-default option must be enabled (AT:P), the attack requires active victim interaction (clicking the link, UI:A), the vector is local (the victim must open a crafted document, AV:L), and commands run only with the victim's own privileges. These conditions make exploitation targeted and social-engineering-dependent rather than remote or automatic.

This is a moderate, condition-gated risk rather than a drop-everything emergency. The supplied CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H) shows full compromise of the victim's host (code execution as the user) but behind three real brakes: the vector is local (AV:L), a specific attack requirement must hold (AT:P - the non-default 'Custom Web Link Clicked Action' option must be enabled), and active user interaction is needed (UI:A - the victim must click the crafted link). PR:N means the attacker needs no privileges on the target. The vuln.today decision label is 'this_week', consistent with code execution potential but not with mass exploitation. No KEV listing, no EPSS score, and no confirmed public exploit were provided in the input, so there is no signal of active or widespread exploitation; the realistic threat is targeted social-engineering (getting a victim who has enabled the non-default option to open a malicious document). Note the input supplies only a CVSS 4.0 vector - no CVSS 3.1 vector - and no EPSS/KEV data, so exploitation-probability signals are absent rather than low. Overall: a genuine code-execution flaw whose real-world risk is substantially limited by the required non-default configuration plus user interaction.

An attacker crafts a CherryTree document containing a web link whose URL embeds shell metacharacters such as $(...), backticks, or a semicolon. The attacker delivers the document to a victim who has enabled the non-default Custom Web Link Clicked Action option; when the victim opens the document and clicks the link, the unquoted URL is passed to std::system and the attacker's commands run as the victim. No public exploit was identified in the provided data, but the source code references (ct_actions_others.cc and ct_misc_utils.cc) pinpoint the vulnerable call path.