CVE-2026-33589

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-33589
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33589.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-33589
Aliases
  • GHSA-842v-h4cj-r646
Published
2026-05-07T11:16:01.150Z
Modified
2026-07-15T06:09:52.659459Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

Lack of user input validation in the file upload functionality of Open Notebook v1.8.3 allows the application user to access local files content from the docker container via path traversal.

References

Affected packages

Git / github.com/lfnovo/open-notebook

Affected ranges

Type
GIT
Repo
https://github.com/lfnovo/open-notebook
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1a35240e1513efd856ca125d7ef243bcb4b3f936
Database specific 
{
    "cpe": "cpe:2.3:a:lfnovo:open-notebook:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.8.4"
        }
    ]
}

Affected versions

v0.*
v0.0.1-alpha
v0.0.10
v0.0.2
v0.0.3
v0.0.4
v0.0.5
v0.0.7
v0.0.8
v0.0.9
v0.1.0
v0.1.1
v0.2.0
v0.2.2
v0.3.0
v0.3.1
v0.3.2
v1.*
v1.0.8
v1.2.0
v1.2.4
v1.3.0
v1.3.1
v1.4.0
v1.5.0
v1.6.2
v1.7.0
v1.7.1
v1.7.2
v1.7.3
v1.7.4
v1.8.0
v1.8.1
v1.8.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33589.json"