CVE-2026-33589
Arbitrary File Read via Local File Inclusion (LFI)
- State
- Published
- Severity
- 8.2 High
- Published
- May 7, 2026
- Updated
- May 7, 2026
- Reserved
- Mar 23, 2026
Description
Lack of user input validation in the file upload functionality of Open Notebook v1.8.3 allows the application user to access local files content from the docker container via path traversal.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.2 High | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N | ENISA |
Weaknesses
- CWE-20 Improper input validation
Affected Products
| Product | Versions |
|---|---|
Open NotebookOpen Notebook |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.