In Ankitects Anki before 25.02.6, crafted sound file references could cause files to be written to arbitrary locations on Windows and Linux (media file pathnames are not necessarily relative to the m…

Low CVSS 2.9

CVECVE-2025-62187

First seen2026-10-08 14:02 UTC

Disclosed2025-10-07 21:15 UTC

Last updated2026-10-08 14:02 UTC

Channel statusauto

Summary

In Ankitects Anki before 25.02.6, crafted sound file references could cause files to be written to arbitrary locations on Windows and Linux (media file pathnames are not necessarily relative to the media folder).

In-depth triage

No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).

Affected products

Sources

NVD DATABASE

Original Links

https://github.com/ankitects/anki/pull/4041 Patch
https://github.com/ankitects/anki/pull/4041/commits/51476e05b281737a0c2924342bccdb6e5be52ea9 Patch
https://github.com/ankitects/anki/releases/tag/25.02.6 Release Notes

Timeline

2026-10-08 nvd_ingest NVD