CVE-2026-64677
MediumCVSS 5.9Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
In Anki prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read local files through directory traversal.
Risk Assessment
An attacker can read local files of the user, potentially leading to disclosure of sensitive data.
Recommendation
Update Anki to version 25.09.3 or later which includes the fix.
Other vulnerabilities in Anki
See all- CVE-2026-59153Low
Anki prior to version 25.09.3 runs a local HTTP server that does not sufficiently block requests from other origins. A malicious website could send requests to this server, potentially causing side effects.
- CVE-2026-58266Medium
A vulnerability in Anki prior to 25.09.4 allows malicious card packages with embedded iframes to access the internal localhost API, enabling reading of arbitrary files accessible to the Anki process and exfiltrating them over the network.
Original NVD description (English source)
Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read local files through directory traversal. This issue is fixed in version 25.09.3.