EUVD-2026-28347
GHSA-c7wf-4r4p-4766
CVSS VectorNVD
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionNVD
Lack of user input validation in the file upload functionality of Open Notebook v1.8.3 allows the application user to create or modify files on the docker container via path traversal.
AnalysisAI
Path traversal in Open Notebook v1.8.3's file upload allows arbitrary file creation or modification within the Docker container filesystem. Attackers with local access can write files outside intended directories, enabling container escape scenarios, configuration tampering, or privilege escalation by overwriting critical system files. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Disable or restrict file upload functionality in Open Notebook v1.8.3 via network controls or application configuration; inventory all instances and document their network exposure. Within 7 days: Implement filesystem-level write restrictions using Docker security policies (read-only root filesystem where feasible); apply network segmentation to limit local access to affected instances. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today