Security Advisory

CVE-2026-64677

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-08-06 17:21:43

Last updated 2026-08-06 17:21:43

Assigner GitHub_M

CVSS score not scored

State PUBLISHED

Description

Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read local files through directory traversal. This issue is fixed in version 25.09.3.

← Browse all CVEs View on cve.org ↗