CVE-2026-33588highCWE-20

CVE-2026-33588: high-severity vulnerability in Open Notebook

Arbitrary File Write Through Path Traversal

Published

Follow this CVE+ Monitor Open Notebook

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7epss 0.2%
Lack of user input validation in the file upload functionality of Open Notebook v1.8.3 allows the application user to create or modify files on the docker container via path traversal.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Open Notebook · Open Notebook
Related CVEs — Open Notebook

In the same product, most dangerous first.

CVE-2026-33587CRITICALRemote Code Execution (RCE) via Server-Side Template Injection (SSTI)EPSS 0.2%CVE-2026-33589HIGHArbitrary File Read via Local File Inclusion (LFI)EPSS 0.2%CVE-2026-28201HIGHSurrealDB Injection on Open NotebookEPSS 0.1%