CVE-2026-33589

Arbitrary File Read via Local File Inclusion (LFI)

CVSS 8.2 HIGHEPSS 0.2%CWE-20

Lack of user input validation in the file upload functionality of Open Notebook v1.8.3 allows the application user to access local files content from the docker container via path traversal.

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Productos afectados

Open Notebook · Open Notebook

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

https://github.com/lfnovo/open-notebook/security/advisories/GHSA-842v-h4cj-r646