CVE-2025-62187

In Ankitects Anki before 25.02.6, crafted sound file references could cause files to be written to arbitrary locations on Windows and Linux (media file pathnames are not necessarily relative to the media folder).

CVSS v3 2.9 LOW

2.9^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.4 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/ankitects/anki/pull/4041	Patch
https://github.com/ankitects/anki/pull/4041/commits/51476e05b281737a0c2924342bccdb6e5be52ea9	Patch
https://github.com/ankitects/anki/releases/tag/25.02.6	Release Notes

Configurations

Configuration 1 (hide)

cpe:2.3:a:ankitects:anki:*:*:*:*:*:*:*:*

History

08 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) En Ankitects Anki antes de 25.02.6, referencias de archivos de sonido elaboradas podrían causar que se escribieran archivos en ubicaciones arbitrarias en Windows y Linux (los nombres de ruta de los archivos multimedia no son necesariamente relativos a la carpeta de medios).

Information

Published : 2025-10-07 21:15

Updated : 2026-10-08 13:10

NVD link : CVE-2025-62187

Mitre link : CVE-2025-62187

CVE.ORG link : CVE-2025-62187

JSON object : View

Products Affected

ankitects

anki

CWE

CWE-23

Relative Path Traversal

{"id": "CVE-2025-62187", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62187", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-08T13:24:27.119690Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.9, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.4}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "Ankitects", "product": "Anki", "versions": [{"status": "affected", "version": "0", "lessThan": "25.02.6", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-07T21:15:39.143", "references": [{"url": "https://github.com/ankitects/anki/pull/4041", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://github.com/ankitects/anki/pull/4041/commits/51476e05b281737a0c2924342bccdb6e5be52ea9", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://github.com/ankitects/anki/releases/tag/25.02.6", "tags": ["Release Notes"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-23"}]}], "descriptions": [{"lang": "en", "value": "In Ankitects Anki before 25.02.6, crafted sound file references could cause files to be written to arbitrary locations on Windows and Linux (media file pathnames are not necessarily relative to the media folder)."}, {"lang": "es", "value": "En Ankitects Anki antes de 25.02.6, referencias de archivos de sonido elaboradas podr\u00edan causar que se escribieran archivos en ubicaciones arbitrarias en Windows y Linux (los nombres de ruta de los archivos multimedia no son necesariamente relativos a la carpeta de medios)."}], "lastModified": "2026-10-08T13:10:00.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ankitects:anki:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "438205D6-5F23-4377-8C3B-71ADE4F7770F", "versionEndExcluding": "25.02.6"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}