CVE-2026-39377

MEDIUM6.5EPSS 0.05%

nbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment Filenames

發布日:2026/4/21修改日:2026/4/30
也稱為:GHSA-4c99-qj7h-p3vgCGA-f6rq-j3wp-j759

描述

# Arbitrary File Write via Path Traversal in Cell Attachment Filenames ## Summary nbconvert allows arbitrary file writes to locations outside the intended output directory when processing notebooks containing crafted cell attachment filenames. The `ExtractAttachmentsPreprocessor` passes attachment filenames directly to the filesystem without sanitization, enabling path traversal attacks. This vulnerability provides complete control over both the destination path and file extension. ## Impact This vulnerability allows writing files with arbitrary content to arbitrary filesystem locations, limited only by the permissions of the process running nbconvert. The attacker controls: - Full destination path (via `../` traversal) - Filename - File extension - File content ## Patches - upgrade to nbconvert v7.17.1 ## Workarounds disable ExtractAttachmentsPreprocessor by setting: ```python c. ExtractAttachmentsPreprocessor.enabled = False ```

受影響套件(2)

CVSS 分數

來源版本嚴重程度向量
osvCVSS 3.1MEDIUM6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

參考連結(5)