Threats Tagged 'cve-2026-66881'

CVE-2026-66881 is a relative path traversal vulnerability in livebook-dev's livebook software. It allows an attacker to craft a malicious notebook that writes files with attacker-controlled content to arbitrary paths on the victim's system. This occurs because the import process does not properly validate file entry names, enabling path traversal outside the intended directory. The vulnerability affects livebook versions from 0.11.0 before 0.18.7 and from 0.19.0 before 0.19.9. Exploitation requires a victim to open a malicious notebook and trigger the file fetch, with no authentication required for the attacker. The CVSS 4.0 score is 7.0, indicating high severity.