CVE-2026-66881 Path traversal in imported file_entries name allows arbitrary file write via URL-type entry download
Attacker-authored notebooks can write arbitrary files to the server via path traversal in imported file entries, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-66881?
CVE-2026-66881 is a high-severity path traversal vulnerability in livebook-dev livebook, published on 5 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Relative Path Traversal vulnerability in livebook-dev livebook allows an attacker-authored notebook to write a file with attacker-controlled content to an arbitrary path.
A .livemd notebook can declare file_entries metadata, each entry carrying a name. Every path that creates a file entry through the user interface validates that name with Livebook.Notebook.validate_file_entry_name/2, which requires a flat filename of alphanumerics, dashes, underscores and dots, ending in an extension. The import path does not: Livebook.LiveMarkdown.Import.file_entry_metadata_to_attrs/1 in lib/livebook/live_markdown/import.ex takes the name verbatim from the notebook source.
For a URL-type file entry, Livebook.Session.file_entry_cache_file/2 in lib/livebook/session.ex resolves that name beneath the session's temporary directory without checking that the result stays inside it, and Livebook.FileSystem.Utils.resolve_unix_like_path/2 collapses parent-directory segments while clamping only at the filesystem root. When the entry's content is requested and no cached copy exists, Livebook fetches the entry's URL and writes the response body to the resolved path, creating parent directories as needed. The attacker therefore controls both the destination and the contents of the written file, which may land anywhere the Livebook process can write. The same missing containment check is present in Livebook.Session.to_attachment_file_entry/2.
A victim who opens an attacker-supplied notebook and causes the entry to be fetched triggers the write within their own authenticated session; the attacker needs no account on the target instance. URL-type entries are also not placed under notebook stamping quarantine on import, so no warning is shown.
This issue affects livebook: from 0.11.0 before 0.18.7 and from 0.19.0 before 0.19.9.
Weakness: CWE-23
Which versions are affected by CVE-2026-66881?
1 open source package ship an affected version, including livebook. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
livebook Hex | From 0.11.0 | 0.18.7, 0.19.9 |
Products include Livebook Livebook.
How do I fix CVE-2026-66881?
Upgrade livebook to a fixed version for your release line: 0.18.7 or 0.19.9.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-66881 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-66881 exists.
Other vulnerabilities in livebook-dev livebook
- CVE-2026-66298 JS-view sandboxed output can synthesize keyboard events to trigger unconfirmed global shortcuts
- CVE-2023-35174 Livebook Desktop's protocol handler can be exploited to execute arbitrary command on Windows
- CVE-2026-68746 Livebook Teams identity check fails open when the deployment group is unresolvable, allowing unauthenticated access
- CVE-2026-66885 Livebook Teams identity callback lacks state binding, allowing login CSRF
- CVE-2026-66297 Unescaped deployment environment variables in generated setup commands
Sources
Also known as EEF-CVE-2026-66881, GHSA-r4h8-2xpq-v48g.