CVE-2026-64677Patch

LOWCVSS 5.9 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read local files through directory traversal. This issue is fixed in version 25.09.3.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
1 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Patch

1100.0%

Full discourse1 post

CyberSignal | Cybersecurity News@XQOPTRX46d
Patch
🃏 Anki vulnerable to local file theft CVE-2026-64677 affects Anki before 25.09.3. Weak path restrictions in its local HTTP server can allow malicious deck content—or websites combined with an origin bypass—to read local files through directory traversal. ✅ Fixed: 25.09.3 🔎 Source: Tenable / GitHub Advisory #Anki #PathTraversal #CyberSecurity #CVE
Post summary
The tweet reports CVE‑2026‑64677 as a path‑traversal flaw in Anki’s local HTTP server, notes that version 25.09.3 fixes it, and cites Tenable/GitHub Advisory sources.
0000051
34 followersView on X

Explore more

Back to dashboard