Vulnerability · Published Oct 19, 2026 · Assigned by VulnCheck
CVE-2026-111915Yank Note before 3.93.1 Path Traversal via /api/help Endpoint
Medium 5.9
In plain English
A medium-severity path traversal in Yank Note from purocean. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).
Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.5%top 60.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files via the path or doc parameter of /api/help. Attackers can supply repeated '../' segments, which bypass the single-replacement sanitization in the publicly allowlisted endpoint, to read SSH keys, configuration, or notes.
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://github.com/purocean/yn/issues/543 issue-tracking
- https://github.com/purocean/yn/commit/d3b0ad27f7f6388b878eefd828557ae2d2a8789b patch
- https://github.com/purocean/yn/blob/v3.93.0/src/main/server/index.ts technical-description
- Yank Note v3.93.1 Release Notes release-notes
- VulnCheck Advisory: Yank Note before 3.93.1 Path Traversal via /api/help Endpoint third-party-advisory