EUVD-2026-54206Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector via local HTTP server, no privileges needed, but active user interaction required (open deck or visit site); confidentiality is high due to arbitrary local file read, with no integrity or availability impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read local files through directory traversal. This issue is fixed in version 25.09.3.
AnalysisAI
Directory traversal in Anki's local HTTP server (versions prior to 25.09.3) exposes arbitrary local files to scripts embedded in shared decks or to malicious websites exploiting an origin-check bypass. The flaw exists in both the media file endpoint and the built-in data path endpoint within qt/aqt/mediasrv.py, where path boundary checks were either absent or bypassable via the missing os.sep suffix. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high confidentiality impact (VC:H) and the realistic social-engineering vector through the AnkiWeb shared deck ecosystem make this a credible threat to active Anki users.
Technical ContextAI
Anki runs a local HTTP server (mediasrv.py) to serve media files and built-in application data when a user is reviewing flashcards. The root cause (CWE-22, Improper Limitation of a Pathname to a Restricted Directory) manifested in two distinct places: (1) the _handle_local_file_request handler used fullpath.startswith(directory) without appending os.sep, meaning a crafted path whose resolved absolute form began with the base directory string but escaped it (e.g., /media/../secret) could satisfy the check; (2) _handle_builtin_file_request explicitly constructed paths as aqt_data_path() / '..' / path, inherently stepping one directory above the data folder before applying any user-supplied path. The fix introduces ensure_safe_path(), which normalizes the base via os.path.realpath(), resolves the candidate path with os.path.abspath(), and enforces containment with startswith(base_dir + os.sep), catching both bypass vectors. An additional attack surface is an origin-check bypass that allows malicious external websites to reach this local HTTP server.
RemediationAI
Upgrade to Anki 25.09.3 or later, which is the vendor-confirmed fixed release per advisory GHSA-78wr-2gg2-4hqg (https://github.com/ankitects/anki/security/advisories/GHSA-78wr-2gg2-4hqg). The fix enforces proper path boundary checks in both media and built-in data handlers. If an immediate upgrade is not possible, two compensating controls are available with trade-offs: first, avoid importing or reviewing decks from untrusted sources on AnkiWeb or third-party repositories - this eliminates the shared-deck vector but does not address the malicious-website vector; second, close or quit Anki while browsing untrusted websites, which eliminates the origin-bypass vector but is operationally disruptive. There is no configuration option to disable the local HTTP server independently without breaking core Anki functionality, so patching is the only complete remediation.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today