CVE-2026-64677 is a CWE-22 path traversal vulnerability in ankitects Anki's local HTTP server. Before version 25.09.3, the server endpoints do not properly restrict access to media and built-in data paths, enabling unauthorized local file reads via directory traversal. This can be triggered by scripts served from shared decks or malicious websites that bypass origin checks. The vulnerability is fixed in Anki version 25.09.3.

Exploitation of this vulnerability allows an attacker to read arbitrary local files on the victim's system through the local HTTP server. This could lead to exposure of sensitive information stored locally. The CVSS 4.0 score is 5.9 (medium severity), reflecting network attack vector, low attack complexity, partial attack traceability, no privileges required, user interaction required, and high impact on confidentiality.

Upgrade Anki to version 25.09.3 or later, where this path traversal vulnerability is fixed. There is no official remediation level or patch link provided, but the vendor has addressed the issue in the stated version. Until upgrading, avoid opening untrusted shared decks or visiting untrusted websites that might exploit this flaw.