Read the docs
TI-2026-47467 Aliases CVE-2026-66881

Path traversal in imported file_entries name allows arbitrary file write via URL-type entry download

Priority MEDIUM 64CWE-23Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Relative Path Traversal vulnerability in livebook-dev livebook allows an attacker-authored notebook to write a file with attacker-controlled content to an arbitrary path. A .livemd notebook can declare file_entries metadata, each entry carrying a name. Every path that creates a file entry through the user interface validates that name with Livebook.Notebook.validate_file_entry_name/2, which requires a flat filename of alphanumerics, dashes, underscores and dots, ending in an extension. The import path does not: Livebook.LiveMarkdown.Import.file_entry_metadata_to_attrs/1 in lib/livebook/live_markdown/import.ex takes the name verbatim from the notebook source. For a URL-type file entry, Livebook.Session.file_entry_cache_file/2 in lib/livebook/session.ex resolves that name beneath the session's temporary directory without checking that the result stays inside it, and Livebook.FileSystem.Utils.resolve_unix_like_path/2 collapses parent-directory segments while clamping only at the filesystem root. When the entry's content is requested and no cached copy exists, Livebook fetches the entry's URL and writes the response body to the resolved path, creating parent directories as needed. The attacker therefore controls both the destination and the contents of the written file, which may land anywhere the Livebook process can write. The same missing containment check is present in Livebook.Session.to_attachment_file_entry/2. A victim who opens an attacker-supplied notebook and causes the entry to be fetched triggers the write within their own authenticated session; the attacker needs no account on the target instance. URL-type entries are also not placed under notebook stamping quarantine on import, so no warning is shown. This issue affects livebook: from 0.11.0 before 0.18.7 and from 0.19.0 before 0.19.9.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00609 49th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed livebook (livebook-dev): 0.18.7, 0.19.9, 0.18.7-cuda12 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
livebook-devlivebook0.11.0 to before 0.18.7; 0.19.0 to before 0.19.90.18.7, 0.19.9Patch availableCNA
livebook-devlivebook0.11.0 to before 0.18.7; 0.19.0 to before 0.19.9; 0.11.0-cuda12 to before 0.18.7-cuda12; 0.19.0-cuda12 to before 0.19.9-cuda120.18.7, 0.19.9, 0.18.7-cuda12, 0.19.9-cuda12Patch availableCNA
  • livebook Vendorlivebook-dev Affected 0.11.0 to before 0.18.7; 0.19.0 to before 0.19.9 Fixed in 0.18.7, 0.19.9 Patch available CNA
  • livebook Vendorlivebook-dev Affected 0.11.0 to before 0.18.7; 0.19.0 to before 0.19.9; 0.11.0-cuda12 to before 0.18.7-cuda12; 0.19.0-cuda12 to before 0.19.9-cuda12 Fixed in 0.18.7, 0.19.9, 0.18.7-cuda12, 0.19.9-cuda12 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:livebook:livebook:*:*:*:*:*:*:*:*0.11.0 to before 0.18.7; 0.19.0 to before 0.19.9Vulnerablelivebook-dev
  • cpe:2.3:a:livebook:livebook:*:*:*:*:*:*:*:* Versions 0.11.0 to before 0.18.7; 0.19.0 to before 0.19.9 Vulnerable ·livebook-dev

Remediation

  • Fix · CNA livebook (livebook-dev) Fixed in 0.18.7, 0.19.9
  • Fix · CNA livebook (livebook-dev) Fixed in 0.18.7, 0.19.9, 0.18.7-cuda12, 0.19.9-cuda12

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    livebook-dev livebook 0.18.7, 0.18.7-cuda12 and 2 more versions

    4 records Highest priority Priority MEDIUM 2 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-47096 Unescaped deployment environment variables in generated setup commandsPriority MEDIUM 56
    • TI-2026-47097 JS-view sandboxed output can synthesize keyboard events to trigger unconfirmed global shortcutsPriority LOW 39
    • TI-2026-47471 Livebook Teams identity callback lacks state binding, allowing login CSRFPriority LOW 30
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-66881

References

Exploit 1

Patch 3

Advisory 2

  • TI-2026-47096 Unescaped deployment environment variables in generated setup commands CVSS 4.0MEDIUM 5.0
  • TI-2023-17619 Livebook Desktop's protocol handler can be exploited to execute arbitrary command on Windows CVSS 3.1CRITICAL 9.8
  • TI-2026-47097 JS-view sandboxed output can synthesize keyboard events to trigger unconfirmed global shortcuts CVSS 4.0HIGH 8.6
  • TI-2026-48332 Livebook Teams identity check fails open when the deployment group is unresolvable, allowing unauthenticated access CVSS 4.0HIGH 7.7
  • TI-2026-47471 Livebook Teams identity callback lacks state binding, allowing login CSRF CVSS 4.0MEDIUM 6.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences