Shiny for Python CVE-2026-108258

Baseline (default apps, including bookmark_store='disable'): no authentication and no opt-in configuration - the restore handler executed on any request carrying a query string, so a single crafted _state_id_ containing parent-directory ('..') segments or an absolute path triggers the traversal; impact is limited to probing existence and JSON-validity of paths, and only for the file names input.json and values.json. Escalated file-read: requires the application to be configured with bookmark_store='server' AND to call ui.input_file(), in which case the file-input restore handler copies an attacker-named file from an attacker-named directory into the app. Limiting factors: the vulnerability exists only in versions 1.4.0 through 1.6.3; the full file-disclosure impact depends on the non-default server+input_file configuration; and the only available mitigation short of upgrading is stripping the _state_id_ parameter at a reverse proxy or load balancer (no in-app setting disables the vulnerable path on affected versions).

This is a genuine but moderate-priority issue, not a critical emergency. The CVSS 4.0 base score of 6.9 (Medium) with vector AV:N/AC:L/AT:N/PR:N/UI:N and VC:L/VI:N/VA:N correctly captures the baseline: a network-reachable, unauthenticated, low-complexity attack whose worst-case impact in the default configuration is limited confidentiality - a server-side probe that reveals only whether an attacker-chosen path exists and contains valid JSON, constrained to the file names input.json and values.json. No EPSS score, KEV listing, or public POC is present in the supplied intelligence; exploitation status is therefore 'no public exploit identified at time of analysis.' The signals are internally consistent (network vector matches an HTTP query-string parameter; PR:N matches the vendor's statement that restore ran even with bookmark_store='disable' and required no opt-in). The important nuance the single score hides is a conditional escalation: applications configured with bookmark_store='server' AND using ui.input_file() can additionally have an attacker-selected file copied and exposed into the application, which is a materially higher confidentiality impact than VC:L suggests - but that path is config-dependent and not reflected in the base vector. Bottom line: prioritize patching for any py-shiny deployment in the 1.4.0-1.6.3 range, with elevated urgency for server-side-bookmark apps that use file inputs; treat the base score as a floor, not a ceiling.

An unauthenticated attacker appends a crafted _state_id_ query parameter containing ../ sequences or an absolute path to a Shiny for Python app URL, causing the server to attempt to open input.json/values.json outside the shiny_bookmarks store and leaking file existence and JSON-validity by response behavior. Against an app running bookmark_store='server' that uses ui.input_file(), the attacker can further direct the restore handler to copy an attacker-chosen file from an attacker-chosen directory into the application, exposing its contents. No public exploit code is identified, but the technique is straightforward to reproduce from the advisory.