CVE-2026-66881: Livebook Path Traversal Vulnerability

CVE-2026-66881 Overview

CVE-2026-66881 is a relative path traversal vulnerability [CWE-23] in livebook-dev/livebook, an interactive notebook platform for the Elixir language. An attacker-authored .livemd notebook can declare a URL-type file_entries metadata entry with a name containing parent-directory segments. When a victim opens the notebook and triggers a fetch, Livebook writes attacker-controlled response content to an arbitrary path writable by the Livebook process. The flaw affects versions from 0.11.0 before 0.18.7 and from 0.19.0 before 0.19.9.

Critical Impact
A victim who opens a malicious notebook triggers a file write within their authenticated session, allowing an unauthenticated attacker to plant files anywhere the Livebook process can write.

Affected Products

Livebook 0.11.0 through 0.18.6
Livebook 0.19.0 through 0.19.8
Fixed in Livebook 0.18.7 and 0.19.9

Discovery Timeline

2026-08-05 - CVE-2026-66881 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-66881

Vulnerability Analysis

Livebook notebooks (.livemd files) can declare file_entries metadata, where each entry carries a name field. User interface paths that create file entries validate the name through Livebook.Notebook.validate_file_entry_name/2, which enforces a flat filename of alphanumerics, dashes, underscores, and dots ending in an extension.

The import path lacks this validation. Livebook.LiveMarkdown.Import.file_entry_metadata_to_attrs/1 in lib/livebook/live_markdown/import.ex accepts the name verbatim from the notebook source. For URL-type entries, Livebook.Session.file_entry_cache_file/2 in lib/livebook/session.ex resolves that name beneath the session's temporary directory without verifying the result stays inside it. Livebook.FileSystem.Utils.resolve_unix_like_path/2 collapses parent-directory segments but only clamps at the filesystem root. The same missing containment check exists in Livebook.Session.to_attachment_file_entry/2.

Root Cause

The root cause is missing input validation on the import path combined with unsafe path resolution. Parent-directory segments (..) in the entry name are collapsed rather than rejected, and no canonicalization check confirms the resolved path remains inside the session's temporary directory. URL-type entries are also not placed under notebook stamping quarantine on import, so no warning is displayed to the user.

Attack Vector

An attacker crafts a .livemd notebook containing a URL-type file_entries entry whose name uses traversal sequences and whose URL points to attacker-controlled content. The attacker distributes the notebook (for example, via a link, a repository, or a message). When the victim opens the notebook and triggers fetching of the entry, Livebook downloads the URL body and writes it to the resolved destination, creating parent directories as needed. The attacker controls both the destination path and the file contents.

text

// Security patch in lib/livebook/live_markdown/import.ex
// Enforces validate_file_entry_name on import so traversal names are rejected.

-  defp file_entry_metadata_to_attrs(%{"type" => "attachment", "name" => name}) do
-    {:ok, %{type: :attachment, name: name}}
+  defp file_entry_metadata_to_attrs(%{"type" => "attachment", "name" => name})
+       when is_binary(name) do
+    with :ok <- validate_file_entry_name(name) do
+      {:ok, %{type: :attachment, name: name}}
+    end
   end

// Source: https://github.com/livebook-dev/livebook/commit/1443dd23df6e7b9203b6797f0695a807aeb81dde

Detection Methods for CVE-2026-66881

Indicators of Compromise

.livemd files whose file_entries metadata contains a name field with .., /, or \ characters instead of a flat filename.
Unexpected files appearing outside the Livebook session temporary directory shortly after a notebook is opened.
HTTP fetches initiated by the Livebook process to unfamiliar external URLs referenced by URL-type file entries.
File writes by the Livebook process to paths outside its designated notebook or cache directories.

Detection Strategies

Scan .livemd files at ingest for file_entries entries whose name fails the flat-filename regex \A[\w\-\.]+\z.
Monitor filesystem activity of the Livebook process for writes outside its temporary and notebook directories.
Alert on notebook imports containing URL-type file entries pointing to external hosts not on an allow list.

Monitoring Recommendations

Log Livebook version across all instances and flag hosts running versions below 0.18.7 or between 0.19.0 and 0.19.8.
Capture process-level file write telemetry from any host running Livebook and correlate with notebook open events.
Track outbound HTTP traffic from Livebook processes to identify fetches triggered by imported notebooks.

How to Mitigate CVE-2026-66881

Immediate Actions Required

Upgrade Livebook to 0.18.7 or 0.19.9 (or later) on all instances.
Instruct users not to open .livemd notebooks received from untrusted sources until the upgrade is complete.
Audit existing notebook stores for .livemd files containing suspicious file_entries names.
Run the Livebook process under a least-privileged user that cannot write outside its intended directories.

Patch Information

The fix is delivered in Livebook 0.18.7 and 0.19.9. See the GitHub Security Advisory GHSA-r4h8-2xpq-v48g and the fix commits 1443dd23, 50f86982, and acf4cb8c0. The patches add validate_file_entry_name/1 enforcement in Livebook.LiveMarkdown.Import.file_entry_metadata_to_attrs/1 and anchor the file-entry name regex with \A/\z to reject embedded newlines. Additional details are available in the CNA advisory and the OSV vulnerability report.

Workarounds

Do not import .livemd notebooks from untrusted or unverified sources.
Restrict filesystem permissions of the Livebook service account so it cannot write outside its notebook and cache directories.
Run Livebook in a container or sandbox with a read-only root filesystem and explicit writable volumes.
Pre-screen .livemd files with a script that rejects any file_entriesname not matching \A[\w\-\.]+\z.

bash

# Verify installed Livebook version and upgrade if vulnerable
mix livebook.version
mix escript.install hex livebook "~> 0.19.9"

# Simple pre-import scan for traversal in file_entries names
grep -RInE '"name"\s*:\s*"[^"]*(\.\./|/|\\\\)[^"]*"' /path/to/notebooks