Nbviewer
Monthly
Path traversal in Jupyter nbviewer through version 1.0.1 allows unauthenticated remote attackers to read files from sibling directories outside the configured local file root by exploiting a string-prefix comparison flaw in LocalFileHandler.can_show(). The access control check uses Python's startswith() without anchoring on a path separator, so a configured root such as /data/notebooks inadvertently permits access to adjacent directories like /data/notebooks_backup or /data/notebooks-private. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but a patch commit is available upstream and the flaw is trivial to exploit manually.
Path traversal in Jupyter nbviewer through version 1.0.1 allows unauthenticated remote attackers to read files from sibling directories outside the configured local file root by exploiting a string-prefix comparison flaw in LocalFileHandler.can_show(). The access control check uses Python's startswith() without anchoring on a path separator, so a configured root such as /data/notebooks inadvertently permits access to adjacent directories like /data/notebooks_backup or /data/notebooks-private. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but a patch commit is available upstream and the flaw is trivial to exploit manually.