CVE-2025-62187

Severity: low (CVSS 3.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-07 · updated 2026-10-08
Weakness: CWE-23

Description

In Ankitects Anki before 25.02.6, crafted sound file references could cause files to be written to arbitrary locations on Windows and Linux (media file pathnames are not necessarily relative to the media folder).

Affected products

Ankitects Anki: before 25.02.6 — fixed in 25.02.6

How to fix

Upgrade to a fixed version: Ankitects Anki 25.02.6. Check the vendor advisory for mitigations.

References

https://github.com/ankitects/anki/pull/4041
https://github.com/ankitects/anki/pull/4041/commits/51476e05b281737a0c2924342bccdb6e5be52ea9
https://github.com/ankitects/anki/releases/tag/25.02.6

Get alerted when CVE-2025-62187 or the next vulnerability affects your stack