https://vulnerability.circl.lu/sightings/feed 2026-10-11T15:56:34.975837+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/29136e98-3d5b-4a7e-8532-cfdfb8975c8c/export 2026-10-11T15:56:34.983522+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "29136e98-3d5b-4a7e-8532-cfdfb8975c8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-47c3-hpmg-7j6p", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117412888597591536", "content": "CVE-2026-108258 Shiny for Python - Path traversal in bookmark restore Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied state_id and joins it into the server-side shiny_bookmarks directory without validating that it is a single safe path segment. An unauthenticated request can use parent-directory segments or an absolute path to make the server open input.json and values.json outside the bookmark store, even when bookmark_store is set to disable. In applications configured with bookmark_store set to server and using ui.input_file(), the restore handler can additionally copy and expose an attacker-selected file from an attacker-selected directory. This issue is fixed in version 1.6.4.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108258https://github.com/posit-dev/py-shiny/security/advisories/GHSA-47c3-hpmg-7j6phttps://github.com/posit-dev/py-shiny/commit/1d8ecb46cbc9621b7dc8812111d26692e086b376https://github.com/posit-dev/py-shiny/releases/tag/v1.6.4#posit-dev #py-shiny#CVE_2026_108258#bot", "creation_timestamp": "2026-10-09T20:41:48.098821Z"} 2026-10-09T20:41:48.098821+00:00