Log in Start free

Vulnerability · Published Apr 21, 2026 · Assigned by GitHub_M

CVE-2026-39377nbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment Filenames

Medium 6.5

In plain English

A medium-severity path traversal in nbconvert from jupyter. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.3%top 81.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions 6.5 through 7.17.0 allow arbitrary file writes to locations outside the intended output directory when processing notebooks containing crafted cell attachment filenames. The `ExtractAttachmentsPreprocessor` passes attachment filenames directly to the filesystem without sanitization, enabling path traversal attacks. This vulnerability provides complete control over both the destination path and file extension. Version 7.17.1 contains a patch.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13nbconvert7.16.6-1+deb13u1DEBIAN-CVE-2026-39377
Debian:14nbconvert7.17.1-1DEBIAN-CVE-2026-39377
PyPInbconvert7.17.1GHSA-4c99-qj7h-p3vg
PyPInbconvert7.17.1PYSEC-2026-2229
Ubuntu:22.04:LTSnbconvertno fix listedUBUNTU-CVE-2026-39377
Ubuntu:24.04:LTSnbconvertno fix listedUBUNTU-CVE-2026-39377
Ubuntu:25.10nbconvertno fix listedUBUNTU-CVE-2026-39377
Ubuntu:26.04:LTSnbconvertno fix listedUBUNTU-CVE-2026-39377
Ubuntu:26.10nbconvertno fix listedUBUNTU-CVE-2026-39377

Affected products (as reported)

VendorProductVersions
jupyter nbconvert >= 6.5, < 7.17.1

Weakness: CWE-22, CWE-73 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

References