CherryTree versions up to 1.7.2 contain an OS command injection flaw in the CtActions::link_clicked handler. When the Non‑default Custom Web Link Clicked Action is enabled, the link URL is passed directly to std::system without proper sanitisation. An attacker who can embed a crafted web link in a document can execute arbitrary shell commands, such as $(...), backticks, or semicolons, when a victim clicks the link. The result is uncontrolled command execution with the privileges of the currently logged‑in user.

The vulnerability exists in the CherryTree application distributed by the CherryTree Project. All releases up to and including version 1.7.2 are affected. There is no version information beyond 1.7.2 in the CVE, so any earlier releases before the bug was discovered are also potentially vulnerable. The affected systems therefore include any computer running CherryTree 1.7.2 or earlier.

The CVSS score of 7.1 indicates a high severity. EPSS data is not available, so the current exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, suggesting no known large‑scale exploitation to date. Exploitation requires an attacker to supply a malicious document with a crafted link and the victim to click that link, making it a user‑interactive attack. In practice, the risk is elevated for environments where users open documents from untrusted sources or where the Custom Web Link Clicked Action is enabled.