SB20260728101 - Path traversal in Anki

Description

This security bulletin contains information about 1 vulnerability.

1) Path traversal (CVE-ID: CVE-2026-58266)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to path traversal in the internal Anki API when processing requests from scripts included via iframes in the editor. A remote attacker can trick the victim into importing an untrusted .apkg and viewing a card with an embedded iframe to disclose sensitive information.

User interaction is required to import an untrusted .apkg and view a card with an embedded iframe.

Remediation

Install update from vendor's website.

References

• https://github.com/ankitects/anki/security/advisories/GHSA-cw6h-ffmh-x6vh
• https://github.com/ankitects/anki/blob/5a9b54e9380c66e26391f0827867d2a728107836/qt/aqt/mediasrv.py#L223