Ankitects Anki path traversal via iframe API access

Executive brief

Anki is a popular flashcard application used for learning and memorization. A security flaw allows malicious flashcard files to bypass safety restrictions and access the computer's internal files. If a user imports and views a specially crafted flashcard deck from an untrusted source, an attacker could steal private files from the user's computer and send them over the internet.

Technical details

Anki uses a webview-based interface that communicates with a Rust backend via a local API. While protections were in place to prevent scripts in the reviewer or editor from accessing this API, scripts embedded within iframes were inadvertently permitted. An attacker can exploit this by crafting a malicious .apkg file containing an iframe that calls internal API methods like 'getImageForOcclusion'. This allows for path traversal (CWE-22) to read any file accessible to the Anki process. The vulnerability is triggered when a user imports and views the malicious card, requiring no special configuration. A fix is available in version 25.09.4.

Affected products

• Ankitects aqt (Anki) <= 25.09.3

Timeline

• 2026-06-19: advisory: GHSA-cw6h-ffmh-x6vh published
• 2026-06-19: patched: Version 25.09.4 released

References

• https://api.github.com/users/Bankde
• https://github.com/Bankde
• https://api.github.com/users/Bankde/gists%7B/gist_id%7D
• https://api.github.com/users/Bankde/repos
• https://avatars.githubusercontent.com/u/12493875?v=4
• https://api.github.com/users/Bankde/events%7B/privacy%7D