The NewNotebook API in Rapid7 Velociraptor does not properly sanitize input parameters, enabling an authenticated user with NOTEBOOK_EDIT permission to perform path traversal. This allows writing notebook records outside the organization's designated data store directory. Although the file extension is restricted to .json.db, the user can overwrite critical metadata files such as ACL records and hunts, leading to data corruption. This vulnerability affects versions before 0.77.2. There is no official remediation level or patch link provided in the data.

An attacker with NOTEBOOK_EDIT permission can overwrite important metadata files by exploiting the path traversal vulnerability, causing data corruption. This can disrupt normal operations related to access control lists, hunts, and other metadata management within Velociraptor. There is no indication of confidentiality or availability impact beyond data integrity issues. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict NOTEBOOK_EDIT permissions to trusted users only to reduce risk. Monitor for updates from Rapid7 regarding patches or official mitigations.