SB20260728102 - Multiple vulnerabilities in Anki

Description

This security bulletin contains information about 2 vulnerabilities.

1) Improper access control (CVE-ID: CVE-2026-59153)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger side-effecting requests.

The vulnerability exists due to improper access control in the local HTTP server when handling requests from other origins. A remote attacker can host a malicious website to trigger side-effecting requests.

Browser behavior affects exposure because some browsers do not enforce private network access restrictions for localhost requests.

2) Path traversal (CVE-ID: CVE-2026-64677)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to path traversal in the local HTTP server endpoints when handling crafted requests for media files or web pages. A remote attacker can send a specially crafted request to disclose sensitive information.

Exploitation from a website requires another vulnerability that permits access to the local server due to insufficient origin checks, while scripts in shared decks can exploit the issue directly.

Remediation

Install update from vendor's website.

References

• https://github.com/ankitects/anki/security/advisories/GHSA-869j-r97x-hx2g
• https://github.com/ankitects/anki/security/advisories/GHSA-78wr-2gg2-4hqg