Threats affecting pkg:github/giuspen/cherrytree

CherryTree versions up to 1.7.2 have an absolute path traversal vulnerability in the CtStorageXmlHelper::_create_image_from_xml function. This flaw allows attackers to craft malicious XML documents with embedded file 'filename' attributes that specify absolute or home directory paths, potentially causing sensitive files like ~/.ssh/id_rsa to be saved into the document. The vulnerability requires local access and user interaction to exploit.

CherryTree versions up to 1.7.2 have an OS command injection vulnerability in the CtActions::link_clicked function. This flaw allows attackers to execute arbitrary OS commands by embedding shell metacharacters in web link URLs when the Custom Web Link Clicked Action option is enabled. The vulnerability arises because crafted links containing $(...), backticks, or semicolons are passed unquoted to std::system, enabling command execution upon link click.