Product
CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked, allowing command execution via shell metacharacters in web link URLs when the non-default Custom Web Link Clicked Action is enabled.