CVE-2026-86258 - nbviewer through 1.0.1 Path Traversal via LocalFileHandler
Brief
CVE ID : CVE-2026-86258
Published : Sept. 6, 2026, 1:17 p. m.
- 7 hours, 32 minutes ago
Description : nbviewer through 1.
- 1 contains a path traversal vulnerability in LocalFileHandler. can_show() that uses string-prefix comparison instead of proper path validation. Attackers can read files from sibling directories outside the configured root by requesting paths that share the root as a textual prefix, disclosing unintended notebooks and credentials.
Severity: 8.2
- HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...