CVE-2026-33589highCWE-20

CVE-2026-33589: high-severity vulnerability in Open Notebook

Arbitrary File Read via Local File Inclusion (LFI)

Published

Follow this CVE+ Monitor Open Notebook

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.2epss 0.2%
Lack of user input validation in the file upload functionality of Open Notebook v1.8.3 allows the application user to access local files content from the docker container via path traversal.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Affected products
Open Notebook · Open Notebook
Related CVEs — Open Notebook

In the same product, most dangerous first.

CVE-2026-33587CRITICALRemote Code Execution (RCE) via Server-Side Template Injection (SSTI)EPSS 0.2%CVE-2026-33588HIGHArbitrary File Write Through Path TraversalEPSS 0.2%CVE-2026-28201HIGHSurrealDB Injection on Open NotebookEPSS 0.1%