Quick answers
- Is CVE-2026-64677 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-64677 being exploited in the wild.
- How severe is CVE-2026-64677?
- Informational severity, published 6 August 2026.
- Which products and versions are affected?
- Ankitects Anki prior to 25.09.3.
- Is there a fix for CVE-2026-64677?
- A patch was published on 2026-09-03: Fixed in version 25.09.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-64677 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-64677?
- Check whether you run Ankitects Anki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a directory traversal (path traversal) issue in Anki's local HTTP server endpoints that serve media files and built-in data. The vulnerable component did not adequately constrain or validate requested file paths, allowing an attacker to use sequences like "../" to navigate outside intended directories. The attack can be triggered from shared deck scripts (which run in the same origin as the server) or from external websites if combined with an origin-check bypass. An attacker can read any file accessible to the Anki process. The fix, applied in version 25.09.3, implements proper path validation (ensure_safe_path) and applies it consistently across both media and built-in data endpoints.
Affected products
- Ankitects Anki prior to 25.09.3
Timeline
- 2026-07-27: disclosed
- 2026-09-03: patched: Fixed in version 25.09.3
- 2026-08-06: advisory