CVE-2026-39377

MEDIUM6.5EPSS 0.05%

nbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment Filenames

Published: 4/21/2026Modified: 4/30/2026
Also known as:GHSA-4c99-qj7h-p3vgCGA-f6rq-j3wp-j759

Description

# Arbitrary File Write via Path Traversal in Cell Attachment Filenames ## Summary nbconvert allows arbitrary file writes to locations outside the intended output directory when processing notebooks containing crafted cell attachment filenames. The `ExtractAttachmentsPreprocessor` passes attachment filenames directly to the filesystem without sanitization, enabling path traversal attacks. This vulnerability provides complete control over both the destination path and file extension. ## Impact This vulnerability allows writing files with arbitrary content to arbitrary filesystem locations, limited only by the permissions of the process running nbconvert. The attacker controls: - Full destination path (via `../` traversal) - Filename - File extension - File content ## Patches - upgrade to nbconvert v7.17.1 ## Workarounds disable ExtractAttachmentsPreprocessor by setting: ```python c. ExtractAttachmentsPreprocessor.enabled = False ```

Affected packages (2)

CVSS scores

SourceVersionSeverityVector
osvCVSS 3.1MEDIUM6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

References (5)