PT-2026-38420 · Open Notebook · Open Notebook

Cert-Eu · Published 2026-05-07 · Updated 2026-05-07 · CVE-2026-33589

NVD

CVSS v4.0

8.2

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Lack of user input validation in the file upload functionality of Open Notebook v1.8.3 allows the application user to access local files content from the docker container via path traversal.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-33589

Affected Products

Open Notebook

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-33589 · Security Note
• https://github.com/lfnovo/open-notebook/security/advisories/GHSA-842v-h4cj-r646 · Vendor Advisory