PT-2025-41189 · Anki · Anki

Michael Lappas · Published 2025-10-07 · Updated 2025-10-07 · CVE-2025-62187

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Anki versions prior to 25.02.6

Description A flaw exists in Anki that allows crafted sound file references to potentially cause files to be written to arbitrary locations on Windows and Linux systems. This occurs because media file pathnames are not necessarily relative to the media folder.

Recommendations Update to version 25.02.6 or later.

Fix

Relative Path Traversal

Weakness Enumeration

CWE-23

Related Identifiers

CVE-2025-62187

Affected Products

Anki

References · 7

• https://github.com/ankitects/anki/pull/4041 · Patch
• https://github.com/ankitects/anki/pull/4041/commits/51476e05b281737a0c2924342bccdb6e5be52ea9 · Patch
• https://osv.dev/vulnerability/CVE-2025-62187 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62187 · Security Note
• https://github.com/ankitects/anki/releases/tag/25.02.6 · Note
• https://twitter.com/CVEnew/status/1975674511774134754 · Twitter Post
• https://t.me/CVEtracker/34376 · Telegram Post