CVE-2025-62187: 
NixOS vulnerability analysis and mitigation

CVE-2025-62187 is a relative path traversal vulnerability in Ankitects Anki, the popular open-source flashcard application, affecting all versions before 25.02.6. Crafted sound file references in Anki cards can cause files to be written to arbitrary locations on Windows and Linux systems, as media file pathnames were not properly restricted to the media folder. The vulnerability was reported by security researcher Michael Lappas, patched on June 1, 2025, and publicly disclosed on October 7, 2025. It carries a CVSS v3.1 base score of 3.3 (Low) (RedHat CVE, Anki Release).

The root cause is a relative path traversal flaw (CWE-23) in Anki's media file handling code. Specifically, the SimpleMpvPlayer on Windows and the MpvManager on Linux passed sound file references directly to the mpv media player process without first sanitizing or restricting the path to the media folder. An attacker could craft a sound tag with a special scheme or path traversal sequence (e.g., ../../) that, when processed by mpv, would cause files to be written outside the intended media directory. The fix, applied in commit 51476e05, added a path() method to SoundOrVideoTag that calls os.path.basename() to strip any directory components before joining with the media folder path (Anki PR #4041, Patch Commit).

Successful exploitation allows an attacker to write files to arbitrary locations on the victim's Windows or Linux filesystem, limited to the integrity of the local system. The confidentiality and availability impacts are rated as none, meaning the vulnerability does not directly expose sensitive data or cause denial of service. However, writing files to critical system directories (e.g., startup folders, configuration directories) could serve as a stepping stone for privilege escalation or persistence, depending on the target environment (RedHat CVE, Anki Release).

1. Craft a malicious Anki deck: Create an Anki .apkg file containing a card with a sound tag referencing a crafted filename, such as [sound:../../AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/malware.exe] on Windows, designed to traverse outside the media folder.
2. Deliver the deck to the victim: Distribute the malicious .apkg file via email, a shared deck repository, or a compromised Anki deck-sharing platform, and convince the victim to import it.
3. Trigger media playback: When the victim reviews the card containing the crafted sound tag, Anki passes the unvalidated filename to the mpv media player process (via SimpleMpvPlayer on Windows or MpvManager on Linux).
4. Achieve arbitrary file write: The mpv process, receiving the traversal path, writes or creates a file at the attacker-specified location outside the media folder, potentially placing a malicious payload in a startup directory or other sensitive location (Anki PR #4041, Anki Release).

• File System: Unexpected files appearing in directories outside the Anki media folder (e.g., %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ on Windows, or ~/.config/ on Linux) with names matching audio file extensions (.mp3, .wav, .ogg).
• File System: Newly created files in system or user startup directories shortly after Anki card review sessions.
• Logs: Anki or mpv process logs showing file paths containing .. sequences or absolute paths outside the expected media folder.
• Process: The mpv subprocess spawned by Anki referencing file paths outside the user's Anki media directory.

Users should upgrade Anki to version 25.02.6 or later immediately, as this release contains the fix that restricts media file paths to the media folder using os.path.basename(). The Anki release notes specifically note that "Windows & Linux users are strongly recommended to update" and that "references to audio files outside of the media folder are no longer allowed." No configuration-based workaround is available for unpatched versions; the only effective mitigation is upgrading. Users should also exercise caution when importing Anki decks from untrusted sources (Anki Release, Anki PR #4041).

The vulnerability was responsibly disclosed by security researcher Michael Lappas, who is credited in both the patch commit and the official release notes. The Anki maintainer (dae) described it as "another security update" and strongly recommended Windows and Linux users update promptly. The fix was reviewed and approved by two Anki contributors (abdnh and iamllama) before merging. No significant broader media coverage or social media discussion has been identified beyond the GitHub pull request and standard CVE aggregator listings (Anki PR #4041, Anki Release).