Anki’s local HTTP server accepts request paths that are not adequately confined, which allows directory traversal. An attacker can use specially crafted URLs to read arbitrary files from the local filesystem. This flaw, a classic example of CWE‑22, permits an attacker to access sensitive data such as personal documents, configuration files, or other hidden files that the running user can read.

The vulnerability affects every installation of Anki running a local HTTP server and using a version older than 25.09.3, the version at which the vulnerability was resolved. The vendor is ankitects, and the product is the Anki flashcard application.

The CVSS score of 5.9 indicates a medium severity. EPSS is not available, so the probability of active exploitation is unknown. The flaw is not listed in the CISA KEV catalog. A local attacker who has control of the Anki process can craft and send a request to the local HTTP server or host a malicious script in a shared deck. By exploiting the directory traversal, the attacker can read any file that the Anki user process can access, without needing elevated privileges.