PatchTheCVECVE-2025-43703: An issue was discovered in Ankitects Anki through 25.02
CVE-2025-43703 is a medium-severity flaw (CVSS 6.1) affecting anki. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An issue was discovered in Ankitects Anki through 25.02. A crafted shared deck can result in attacker-controlled access to the internal API (even though the attacker has no knowledge of an API key) through approaches such as scripts or the SRC attribute of an IMG element. NOTE: this issue exists because of an incomplete fix for CVE-2024-32484.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.1 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 0.2% (top 86%) |
| CISA exploited list | No |
| Weakness | CWE-830 |
| Published | 2025-04-16 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-43703?
anki: upgrade to newer than 25.02. Exact commands for each OS are on this page.
Is CVE-2025-43703 being exploited?
CVE-2025-43703 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-43703 affect?
CVE-2025-43703 affects anki. Severity is medium (CVSS 6.1). An issue was discovered in Ankitects Anki through 25.02. A crafted shared deck can result in attacker-controlled access to the internal API (even though the attacker has no knowledge of an API key) through approaches such as scripts or the
How urgent is CVE-2025-43703?
Priority 25/100. No elevated risk signals yet.
Related CVEs
- CVE-2025-62185 MEDIUM 6.7 UPGRADE In Ankitects Anki before 25.02.5, a crafted shared deck can place a YouTube downloader executable in the media
- CVE-2025-62186 MEDIUM 6.7 UPGRADE Ankitects Anki before 25.02.5 allows a crafted shared deck on Windows to execute arbitrary commands when playi
- CVE-2025-62187 LOW 2.9 UPGRADE In Ankitects Anki before 25.02.6, crafted sound file references could cause files to be written to arbitrary l
- CVE-2024-32484 HIGH 7.4 DOWNGRADE An reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 2
- CVE-2024-32152 LOW 3.1 DOWNGRADE A blocklist bypass vulnerability exists in the LaTeX functionality of Ankitects Anki 24.04