CVE-2024-29073 MEDIUM

CVE-2024-29073

Vendor Ankitects

Product Anki

Weakness CWE-829 · Inclusion from untrusted sphere

Published July 22, 2024

Last update November 4, 2025

View on NVD All CVEs

CVSS base score

5.3/10

Attack vector Network

Attack complexity High

Privileges required None

User interaction Required

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

An vulnerability in the handling of Latex exists in Ankitects Anki 24.04. When Latex is sanitized to prevent unsafe commands, the verbatim package, which comes installed by default in many Latex distributions, has been overlooked. A specially crafted flashcard can lead to an arbitrary file read. An attacker can share a flashcard to trigger this vulnerability.

Key dates

02Disclosure timeline

July 22, 2024 CVE published

November 4, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-29073 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/829.html

Related vulnerabilities

04Related CVE

CVE-2021-32802 Preview generation used third-party library not suited for user-generated content in Nextcloud server CVE-2022-49042 CVE-2024-38476 Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect CVE-2021-29427 Repository content filters do not work in Settings pluginManagement CVE-2022-31156 Gradle's dependency verification can ignore checksum verification when signature verification cannot be performed