CVE-2024-32152
Ankitects Anki LaTeX Blocklist Bypass vulnerability
A blocklist bypass vulnerability exists in the LaTeX functionality of Ankitects Anki 24.04. A specially crafted malicious flashcard can lead to an arbitrary file creation at a fixed path. An attacker can share a malicious flashcard to trigger this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
A blocklist bypass vulnerability exists in the LaTeX functionality of Ankitects Anki 24.04. A specially crafted malicious flashcard can lead to an arbitrary file creation at a fixed path. An attacker can share a malicious flashcard to trigger this vulnerability.
- Record
CVE-2024-32152- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-184
- Updated
- 2026-11-02
EUVDEUVD-2024-2397
A blocklist bypass vulnerability exists in the LaTeX functionality of Ankitects Anki 24.04. A specially crafted malicious flashcard can lead to an arbitrary file creation at a fixed path. An attacker can share a malicious flashcard to trigger this vulnerability.
- Record
EUVD-2024-2397- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-q47p-v5rw-v574
Ankitects Anki LaTeX Blocklist Bypass vulnerability
A blocklist bypass vulnerability exists in the LaTeX functionality of Ankitects Anki 24.04. A specially crafted malicious flashcard can lead to an arbitrary file creation at a fixed path. An attacker can share a malicious flashcard to trigger this vulnerability.
- Record
GHSA-q47p-v5rw-v574- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-184
- Updated
- 2026-11-02
NVD
A blocklist bypass vulnerability exists in the LaTeX functionality of Ankitects Anki 24.04. A specially crafted malicious flashcard can lead to an arbitrary file creation at a fixed path. An attacker can share a malicious flashcard to trigger this vulnerability.
- Record
CVE-2024-32152- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-184
- Updated
- 2026-11-02
OSV
A blocklist bypass vulnerability exists in the LaTeX functionality of Ankitects Anki 24.04. A specially crafted malicious flashcard can lead to an arbitrary file creation at a fixed path. An attacker can share a malicious flashcard to trigger this vulnerability.
- Record
CVE-2024-32152- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-32152
A blocklist bypass vulnerability exists in the LaTeX functionality of Ankitects Anki 24.04. A specially crafted malicious flashcard can lead to an arbitrary file creation at a fixed path. An attacker can share a malicious flashcard to trigger this vulnerability.
- Record
DEBIAN-CVE-2024-32152- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-q47p-v5rw-v574
Ankitects Anki LaTeX Blocklist Bypass vulnerability
A blocklist bypass vulnerability exists in the LaTeX functionality of Ankitects Anki 24.04. A specially crafted malicious flashcard can lead to an arbitrary file creation at a fixed path. An attacker can share a malicious flashcard to trigger this vulnerability.
- Record
GHSA-q47p-v5rw-v574- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-184
- Updated
- 2026-11-02
OSVPYSEC-2026-1117
Ankitects Anki LaTeX Blocklist Bypass vulnerability
A blocklist bypass vulnerability exists in the LaTeX functionality of Ankitects Anki 24.04. A specially crafted malicious flashcard can lead to an arbitrary file creation at a fixed path. An attacker can share a malicious flashcard to trigger this vulnerability.
- Record
PYSEC-2026-1117- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-32152
A blocklist bypass vulnerability exists in the LaTeX functionality of Ankitects Anki 24.04. A specially crafted malicious flashcard can lead to an arbitrary file creation at a fixed path. An attacker can share a malicious flashcard to trigger this vulnerability.
- Record
UBUNTU-CVE-2024-32152- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ankiPyPI |
before 24.6 | 24.6 |
ankiDebian:11 |
All versions, plus listed versions 2.1.15+dfsg-32.1.15+dfsg-4 |
None known |
ankiPyPI |
before 24.6, plus listed versions 2.1.242.1.252.1.262.1.282.1.29 Show 45 moreShow less2.1.302.1.312.1.322.1.332.1.342.1.352.1.362.1.372.1.37rc12.1.382.1.38b12.1.38b22.1.38b32.1.38b42.1.392.1.39b12.1.39b22.1.402.1.412.1.41b12.1.41b22.1.41b32.1.41b42.1.41b52.1.41b62.1.41b72.1.422.1.432.1.43b12.1.442.1.44b12.1.452.1.45a12.1.45a22.1.45a32.1.45a42.1.45b12.1.45b22.1.45b32.1.45b42.1.45b52.1.45b62.1.45rc12.1.45rc22.1.46 |
24.6 |
ankiUbuntu:16.04:LTS |
All versions, plus listed versions 2.0.32+dfsg-1 |
None known |
ankiUbuntu:18.04:LTS |
All versions, plus listed versions 2.1.0+dfsg~a12-0.12.1.0+dfsg~b24-12.1.0+dfsg~b25-12.1.0+dfsg~b26-12.1.0+dfsg~b27-1 Show 6 moreShow less2.1.0+dfsg~b29-12.1.0+dfsg~b31-12.1.0+dfsg~b33-12.1.0+dfsg~b34-12.1.0+dfsg~b35-12.1.0+dfsg~b36-1 |
None known |
ankiUbuntu:20.04:LTS |
All versions, plus listed versions 2.1.8+dfsg-1ubuntu12.1.15+dfsg-1 |
None known |
ankiUbuntu:22.04:LTS |
All versions, plus listed versions 2.1.15+dfsg-32.1.15+dfsg-3ubuntu0.1 |
None known |
ankiUbuntu:24.04:LTS |
All versions, plus listed versions 2.1.15+dfsg-3ubuntu12.1.15+dfsg-3ubuntu22.1.15+dfsg-3ubuntu32.1.15+dfsg-3ubuntu42.1.15+dfsg-3ubuntu4.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-32152 is a low vulnerability (CVSS 3.1) in Ankitects Anki, published July 22, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 12.3%, the 96th percentile. Fixed in anki 24.6.
References
Left out here: 88 versions. The JSON record has them.