EUVD-2026-56184
GHSA-48j3-8whw-hq63
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Network-accessible API requiring only low-privilege authenticated access with NOTEBOOK_EDIT; integrity is high due to ACL/metadata overwrite, availability low, no confidentiality impact.
Primary rating from Vendor (rapid7).
CVSS VectorVendor: rapid7
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Lifecycle Timeline
3DescriptionCVE.org
The NewNotebook API does not sufficiently sanitize its parameters allowing an authenticated user with NOTEBOOK_EDIT permission to write the notebook record outside the org's data store directory. The file written must have an extension of ".json.db" but can otherwise overwrite other metadata files (such as ACL records, hunts etc). This can corrupt these files and cause data corruption.
AnalysisAI
Path traversal in Velociraptor's NewNotebook API allows authenticated users holding NOTEBOOK_EDIT permission to write files outside the organization's designated data store directory. While the written file is constrained to the '.json.db' extension, this is sufficient to overwrite critical internal metadata files - including ACL records and hunt configurations - causing data corruption that can undermine the integrity of active forensic investigations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Velociraptor user account with the NOTEBOOK_EDIT permission explicitly granted - unauthenticated exploitation is not possible per the CVSS PR:L vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.1 (High) rating is grounded in a network-accessible attack vector with low complexity and no user interaction, but is appropriately tempered by the requirement for low-privilege authenticated access (PR:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a legitimate Velociraptor account that holds NOTEBOOK_EDIT permission crafts an API call to the NewNotebook endpoint, supplying a notebook path containing directory traversal sequences (e.g., '../../hunts/active_hunt') to target a hunt metadata file. The server writes a malformed '.json.db' file at the traversed path, corrupting the hunt record and potentially rendering an active forensic investigation unrecoverable. … |
| Remediation | Consult the Rapid7 vendor advisory at http://docs.velociraptor.app/announcements/advisories/cve-2026-18640/ for the specific patched Velociraptor version; a precise fix version is not independently confirmed from available data so the advisory is the authoritative source. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit Velociraptor user accounts with NOTEBOOK_EDIT permission and document current holders; restrict this permission to only essential personnel and validate access logs for suspicious notebook creation activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Velociraptor
View allPrivilege escalation in Velociraptor's notebook VQL execution path allows analyst-role users to bypass the COLLECT_CLIEN
Privilege escalation to administrator in Rapid7 Velociraptor (all versions before 0.77.2) allows an authenticated low-pr
Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do
Privilege escalation in Velociraptor allows any user with the NOTEBOOK_EDIT permission - typically an analyst-level role
Rapid7 Velociraptor allows users to be created with different privileges on the server. Rated high severity (CVSS 8.8),
Privilege escalation in Rapid7 Velociraptor's multi-tenant org management allows child org administrators to delete any
Remote code execution in Rapid7 Velociraptor server (primarily Linux) allows authenticated clients to write malicious me
Cross-site scripting in Velociraptor's web GUI arises from unsanitized URL scheme handling in URL-typed table columns, e
We need to produce a JSON object with all specified fields, based on provided data. The CVE is CVE-2026-6290, about Velo
Cross-organization ACL disclosure in Velocidex Velociraptor before 0.76.5 allows any authenticated low-privilege user to
Account takeover in Rapid7 Velociraptor is possible when the platform is configured to use an external OIDC Identity Pro
Out-of-bounds read and memory exhaustion flaws in Velociraptor's NTFS parsing library allow denial of service when proce
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today