p PatchFirst

CVE-2026-39377

CVE-2026-39377 · nbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment Filenames

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions 6.5 through 7.17.0 allow arbitrary file writes to locations outside the intended output directory when processing notebooks containing crafted cell attachment filenames. The `ExtractAttachmentsPreprocessor` passes attachment filenames directly to the filesystem without sanitization, enabling path traversal attacks. This vulnerability provides complete control over both the destination path and file extension. Version 7.17.1 contains a patch.

CVSS 6.5 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • nbconvert

    Versions
    • >= 6.5, < 7.17.1: Affected

    No fix published

  • nbconvert Debian:13

    Versions
    • 7.16.6-1
    Affected ranges
    • ECOSYSTEM: < 7.16.6-1+deb13u1

    Update to 7.16.6-1+deb13u1

  • nbconvert Debian:14

    Versions
    • 7.16.6-1
    • 7.17.0-1
    Affected ranges
    • ECOSYSTEM: < 7.17.1-1

    Update to 7.17.1-1

  • nbconvert PyPI

    Versions
    • 6.5.0
    • 6.5.1
    • 6.5.2
    • 6.5.3
    • 6.5.4
    • 7.0.0
    • 7.0.0rc0
    • 7.0.0rc1
    • 7.0.0rc2
    • 7.0.0rc3
    • 7.1.0
    • 7.10.0
    • 7.11.0
    • 7.12.0
    • 7.13.0
    • 7.13.1
    • 7.14.0
    • 7.14.1
    • 7.14.2
    • 7.15.0
    • 7.16.0
    • 7.16.1
    • 7.16.2
    • 7.16.3
    • 7.16.4
    • 7.16.5
    • 7.16.6
    • 7.17.0
    • 7.2.0
    • 7.2.1
    • 7.2.10
    • 7.2.2
    • 7.2.3
    • 7.2.4
    • 7.2.5
    • 7.2.6
    • 7.2.7
    • 7.2.8
    • 7.2.9
    • 7.3.0
    • 7.3.1
    • 7.4.0
    • 7.5.0
    • 7.6.0
    • 7.7.0
    • 7.7.1
    • 7.7.2
    • 7.7.3
    • 7.7.4
    • 7.8.0
    • 7.9.0
    • 7.9.1
    • 7.9.2
    Affected ranges
    • ECOSYSTEM: ≥ 6.5.0, < 7.17.1

    Update to 7.17.1

  • nbconvert Ubuntu:18.04:LTS

    Versions
    • 4.2.0-4
    • 5.3.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nbconvert Ubuntu:20.04:LTS

    Versions
    • 5.4-2ubuntu2
    • 5.6.0-1
    • 5.6.0-2
    • 5.6.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nbconvert Ubuntu:22.04:LTS

    Versions
    • 5.6.1-3
    • 6.1.0-1
    • 6.3.0-1
    • 6.4.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nbconvert Ubuntu:24.04:LTS

    Versions
    • 6.5.3-4
    • 6.5.3-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nbconvert Ubuntu:25.10

    Versions
    • 7.16.6-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nbconvert Ubuntu:26.10

    Versions
    • 7.17.0-1
    • 7.17.1-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nbconvert Ubuntu:26.04:LTS

    Versions
    • 7.16.6-1
    • 7.17.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →