PT-2026-56266 · Anki · Anki
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Anki versions prior to 25.09.4
Description
Webview-based pages communicate with the Rust backend via an internal localhost API. User scripts included through iframes in the editor can bypass protections to access this API. A malicious imported card package containing an embedded iframe can utilize the
getImageForOcclusion() function to read arbitrary files accessible to the process and exfiltrate them over the network.Recommendations
Update to version 25.09.4.
Exploit
Fix
Path traversal
Origin Validation Error
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Anki