GCVE - cpe:2.3:a:ankitects:anki:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:ankitects:anki:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Ankitects (`8844526a-9309-5499-909a-410f664c1c4d`)
Product	Anki (`e7a18540-f1b6-59b9-a7a2-c07fbab0df75`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/ankitects/anki`	purl2cpe	2026-06-01 10:11:14.759564

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-64677`	vulnerable	2026-09-16 04:33:10.775963	Anki's local HTTP server is vulnerable to directory traversal attacks Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read local files through directory traversal. This issue is fixed in version 25.09.3. Published: 2026-08-06T17:21:43.035Z Updated: 2026-08-08T02:17:23.705Z Open on db.gcve.eu Reference links https://github.com/ankitects/anki/security/advisories/GHSA-78wr-2gg2-4hqg https://github.com/ankitects/anki/commit/f4692e54a4fafc89528afab1983f0b98d593023f	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-59153`	vulnerable	2026-07-29 01:03:17.395273	Anki's local HTTP server does not sufficiently validate requests Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, Anki launches a local HTTP server to serve media files and web pages for parts of its interface, but requests from other origins were not sufficiently blocked. A malicious website could potentially trigger side-effecting requests to the local server, with severity varying by browser depending on Private Network Access protections. This issue is fixed in version 25.09.3. Published: 2026-07-07T21:11:01.808Z Updated: 2026-07-08T13:50:15.783Z Open on db.gcve.eu Reference links https://github.com/ankitects/anki/security/advisories/GHSA-869j-r97x-hx2g https://github.com/ankitects/anki/commit/858e5689d0e4fd24f74856c7e8f245412694a219 https://github.com/ankitects/anki/releases/tag/25.09.3 https://x.com/taviso/status/2051310678800253318	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-58266`	vulnerable	2026-07-29 01:03:16.722553	Anki: User scripts in iframes have access to the internal Anki API MEDIUM (6.5) Anki is a program for creating and reviewing flashcards. Prior to 25.09.4, Anki's webview-based pages communicate with the Rust backend using an internal localhost API, and user scripts included via iframes in the editor can access this API despite protections intended to block reviewer and editor scripts. A malicious imported card package with an embedded iframe can use exposed API methods such as getImageForOcclusion to read arbitrary files accessible to the Anki process and exfiltrate them over the network. This issue is fixed in version 25.09.4. Published: 2026-07-07T21:13:42.650Z Updated: 2026-07-08T13:23:46.962Z Open on db.gcve.eu Reference links https://github.com/ankitects/anki/security/advisories/GHSA-cw6h-ffmh-x6vh https://github.com/ankitects/anki/commit/b2b68d829e853da51b5de8aad6c13b53e90bc20d https://github.com/ankitects/anki/releases/tag/25.09.4	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-62187`	vulnerable	2026-06-08 07:37:28.761612	Details available LOW (2.9) In Ankitects Anki before 25.02.6, crafted sound file references could cause files to be written to arbitrary locations on Windows and Linux (media file pathnames are not necessarily relative to the media folder). Published: 2025-10-07T00:00:00.000Z Updated: 2025-10-08T13:24:39.026Z Open on db.gcve.eu Reference links https://github.com/ankitects/anki/releases/tag/25.02.6 https://github.com/ankitects/anki/pull/4041 https://github.com/ankitects/anki/pull/4041/commits/51476e05b281737a0c2924342bccdb6e5be52ea9	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-62186`	vulnerable	2026-06-08 07:37:28.761358	Details available MEDIUM (6.7) Ankitects Anki before 25.02.5 allows a crafted shared deck on Windows to execute arbitrary commands when playing audio because of URL scheme mishandling. Published: 2025-10-07T00:00:00.000Z Updated: 2025-10-08T13:27:47.374Z Open on db.gcve.eu Reference links https://github.com/ankitects/anki/releases/tag/25.02.5	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-62185`	vulnerable	2026-06-08 07:37:28.761060	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-43703`	vulnerable	2026-06-08 07:25:09.267239	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-32484`	vulnerable	2026-06-08 06:35:33.203756	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-32152`	vulnerable	2026-06-08 06:35:32.976210	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-29073`	vulnerable	2026-06-08 06:33:28.649194	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-26020`	vulnerable	2026-06-08 06:31:24.660573	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.