CVE-2026-7810 Details
Description
A flaw has been found in UsamaK98 python-notebook-mcp up to a05a232815809a7e425b5fa7be26e0d4369894c2. Impacted is the function create_notebook/read_notebook/edit_cell/add_cell of the file server.py. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit has been published and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
A path traversal vulnerability has been identified in UsamaK98's python-notebook-mcp application, specifically in the notebook manipulation functions of server.py. This flaw allows for absolute paths or traversal payloads to escape the initialized workspace, enabling unauthorized read or write access to notebook files outside the designated directory. The vulnerability can be exploited remotely, and although the project has been notified, no response has been received.
It is recommended to update the path handling logic to canonicalize paths and enforce strict boundaries within the workspace directory. Absolute paths should be rejected from untrusted inputs unless explicitly allowed, and traversal segments should be blocked after normalization. Additionally, regression tests should be added to cover absolute and traversal payloads on both Linux and Windows.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 5, 2026CISA-ADP
Assessed May 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/UsamaK98/python-notebook-mcp/ | [email protected] | ProductSource CodeVendor |
| https://github.com/UsamaK98/python-notebook-mcp/issues/5 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/submit/807748 | [email protected] | Permission Required |
| https://vuldb.com/vuln/361070 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/361070/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| UsamaK98 python-notebook-mcp | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 5, 2026 | New CVE Received | [email protected] |