EUVD-2026-53600Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network delivery with no required privileges (PR:N) but mandatory victim interaction to trigger fetch (UI:R); no confidentiality impact, high integrity from arbitrary attacker-controlled file write.
Primary rating from Vendor (6b3ad84c-e1a6-4bf7-a703-f496b71e49db).
CVSS VectorVendor: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Lifecycle Timeline
4DescriptionCVE.org
Relative Path Traversal vulnerability in livebook-dev livebook allows an attacker-authored notebook to write a file with attacker-controlled content to an arbitrary path.
A .livemd notebook can declare file_entries metadata, each entry carrying a name. Every path that creates a file entry through the user interface validates that name with Livebook.Notebook.validate_file_entry_name/2, which requires a flat filename of alphanumerics, dashes, underscores and dots, ending in an extension. The import path does not: Livebook.LiveMarkdown.Import.file_entry_metadata_to_attrs/1 in lib/livebook/live_markdown/import.ex takes the name verbatim from the notebook source.
For a URL-type file entry, Livebook.Session.file_entry_cache_file/2 in lib/livebook/session.ex resolves that name beneath the session's temporary directory without checking that the result stays inside it, and Livebook.FileSystem.Utils.resolve_unix_like_path/2 collapses parent-directory segments while clamping only at the filesystem root. When the entry's content is requested and no cached copy exists, Livebook fetches the entry's URL and writes the response body to the resolved path, creating parent directories as needed. The attacker therefore controls both the destination and the contents of the written file, which may land anywhere the Livebook process can write. The same missing containment check is present in Livebook.Session.to_attachment_file_entry/2.
A victim who opens an attacker-supplied notebook and causes the entry to be fetched triggers the write within their own authenticated session; the attacker needs no account on the target instance. URL-type entries are also not placed under notebook stamping quarantine on import, so no warning is shown.
This issue affects livebook: from 0.11.0 before 0.18.7 and from 0.19.0 before 0.19.9.
AnalysisAI
Path traversal in Livebook's notebook import pipeline allows an attacker who supplies a crafted .livemd file to write attacker-controlled content to arbitrary filesystem paths accessible by the Livebook process. Affected versions span 0.11.0 through 0.18.6 and 0.19.0 through 0.19.8, and the attack requires no credentials on the target instance - only that the victim open the malicious notebook and trigger a URL entry fetch. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, but the attack surface is realistic given Livebook's design as a notebook-sharing platform.
Technical ContextAI
Livebook is an Elixir-based interactive notebook platform (analogous to Jupyter) that parses .livemd files declaring file_entries metadata. The root cause is CWE-23 (Relative Path Traversal): the import parser Livebook.LiveMarkdown.Import.file_entry_metadata_to_attrs/1 in lib/livebook/live_markdown/import.ex accepts the name field from notebook source verbatim, bypassing the validation enforced on the UI path by Livebook.Notebook.validate_file_entry_name/2. For URL-type entries, Livebook.Session.file_entry_cache_file/2 resolves that unvalidated name beneath the session's temporary directory via Livebook.FileSystem.Utils.resolve_unix_like_path/2, which collapses ../ segments but clamps only at the filesystem root rather than the session boundary. When the entry URL is fetched and no cached copy exists, Livebook writes the HTTP response body to the resolved path, creating parent directories as needed - giving the attacker control over both write destination and written content. The same missing containment exists in Livebook.Session.to_attachment_file_entry/2. The fix (commits 1443dd23, 50f86982, acf4cb8c) retrofits validate_file_entry_name validation into the import path for all three entry types (attachment, file, url), mirroring the UI-enforced allowlist of alphanumerics, dashes, underscores, and dots with a required extension.
RemediationAI
Upgrade to Livebook 0.18.7 (for the 0.18.x stream) or 0.19.9 (for the 0.19.x stream), as specified in the GitHub Security Advisory at https://github.com/livebook-dev/livebook/security/advisories/GHSA-r4h8-2xpq-v48g. The patched releases apply name validation to the import parser for all file entry types, closing the traversal path. Note: fix version numbers are stated in the advisory but were not independently verified against a published Hex.pm release tag in the provided data. If immediate upgrade is not possible, restrict the Livebook instance to authenticated, trusted users only and prohibit opening notebooks from untrusted sources - this addresses the UI:A user-interaction requirement that is the primary exploitation gate. Blocking outbound HTTP from the Livebook process at the network layer would prevent the URL-fetch step that triggers the file write, but would also disable legitimate URL-type file entries as a side effect. There is no in-product warning for malicious URL-type entries, so user training alone is insufficient as a compensating control.
Livebook is a web application for writing interactive and collaborative code notebooks. Rated critical severity (CVSS 9.
Untrusted JavaScript rendered in Livebook notebook outputs can escape the sandboxed cross-origin iframe and trigger sess
Full unauthenticated access to Livebook 0.19.7-0.19.9 is possible when a Livebook Agent or App Server's deployment group
Session hijacking via OAuth CSRF in Livebook's Livebook Teams identity provider allows an organization-member attacker t
Remote command injection in livebook-dev Livebook's deployment setup command generator allows an authenticated high-priv
Same weakness CWE-23 – Relative Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today