CVE-2026-39378 — Path Traversal in Nbconvert

CWE-22 — Path TraversalCWE-73 — External Control of File Name or PathCWE-23 — Relative Path Traversal4 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
0.0%
top 89.63%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
20
Jupyter NbconvertMTA Mta-solution-server-rhel9Rhoai Odh-pipeline-runtime-datascience-cpu-py312-rhel9+17 more
Timeline
PublishedApr 21

Description

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. In versions 6.5 through 7.17.0, when `HTMLExporter.embed_images=True`, nbconvert's markdown renderer allows arbitrary file read via path traversal in image references. A malicious notebook can exfiltrate sensitive files from the conversion host by embedding them as base64 data URIs in the output HTML. nbconvert 7.17.1 contains a fix. As a workaround, do not enable `HTMLExporter.embed_i…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages21 packages

▶PyPIjupyter/nbconvert6.5.0 — 7.17.1
▶CVEListV5jupyter/nbconvert>= 6.5, < 7.17.1

🔴Vulnerability Details

1
GHSA
nbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image Embedding↗2026-04-21
▶

📋Vendor Advisories

1
Red Hat
nbconvert: nbconvert: Sensitive file exfiltration via path traversal in image references↗2026-04-21
▶

💬Community

1
Bugzilla
CVE-2026-39378 nbconvert: nbconvert: Sensitive file exfiltration via path traversal in image references↗2026-04-21
▶
CVE-2026-39378 — Path Traversal in Jupyter Nbconvert | cvebase