Description

nbviewer through 1.0.1 contains a path traversal vulnerability in LocalFileHandler.can_show() that uses string-prefix comparison instead of proper path validation. Attackers can read files from sibling directories outside the configured root by requesting paths that share the root as a textual prefix, disclosing unintended notebooks and credentials.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-09-06T13:17:10.830Z",
  "pubdate": "2026-09-06T13:17:10.830Z",
  "executiveSummary": "A critical path traversal vulnerability exists in nbviewer versions up to and including 1.0.1, specifically within the LocalFileHandler.can_show() function. The vulnerability arises from an improper validation mechanism that relies on insecure string-prefix comparison rather than normalized path resolution. This flaw permits an attacker to bypass intended directory restrictions, granting unauthorized access to arbitrary files residing in directories adjacent to the designated document root.\nThe impact is significant, as successful exploitation enables the disclosure of sensitive information, including private notebooks and system-level configuration files or credentials stored in sibling directories. The vulnerability is accessible via standard HTTP requests, and the attacker does not require prior authentication to traverse the file system structure. Organizations deploying nbviewer are at risk of unauthorized data exfiltration, necessitating immediate attention to input validation logic to prevent directory escaping.",
  "technicalDetails": "The core issue resides in the LocalFileHandler.can_show() component, which is responsible for verifying that requested file paths are contained within the root directory specified by the nbviewer configuration. The implementation employs a string-prefix comparison method to determine if a requested path is a descendant of the root directory. Because the application compares the raw, unnormalized path strings rather than verifying the resolved canonical path, it fails to account for path traversal sequences.\nExploitation is achieved by constructing a malicious URI that mimics the structure of the root directory but escapes the intended boundary. For example, if the root directory is '/var/lib/nbviewer/data', an attacker may attempt to access files outside this scope by requesting paths that resolve to parent or sibling directories while satisfying the prefix check. By leveraging the faulty logic in can_show(), the handler incorrectly validates the path as being within the root directory, subsequently allowing the application to serve the content of the target file.\nThe attack flow follows these steps: first, the attacker identifies the service endpoint handled by LocalFileHandler. Second, the attacker crafts an HTTP request containing a crafted path sequence designed to bypass the string-prefix check. Third, the LocalFileHandler validates the malicious string as 'safe' because it textually contains the root path prefix. Finally, the application processes the request, performs a file system operation on the resolved malicious path, and returns the contents of the unauthorized file to the attacker.\nThis vulnerability is particularly dangerous because it does not require administrative privileges or complex exploit chains; it is a direct result of improper security boundary enforcement within the application's file handling logic. The lack of canonicalization—such as using functions like os.path.realpath() or equivalent logic—prevents the application from correctly interpreting path components like '..' or symlinks, thereby enabling the traversal of the underlying file system. The post-exploitation impact includes the potential for credential harvesting, source code disclosure, and secondary system compromise depending on what files are accessible in the sibling directories relative to the nbviewer data root."
}