CVE-2026-108258Medium▾ SunlitShiny for Python has path traversal in bookmark restore
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Shiny for Python's bookmark-restore path accepted a client-supplied _state_id_
query-string value and joined it into the server-side bookmark directory
(<cwd>/shiny_bookmarks/<id>) without validating it. A value containing ..
path segments, or an absolute path, could therefore cause the server to open and
parse input.json and values.json from a directory outside the bookmark store.
On a default application the restore was attempted whenever the client supplied a
URL query string — including when bookmarking was disabled
(bookmark_store="disable") — so no opt-in configuration was required. For such
applications the impact is an unauthenticated, server-side probe for the
existence and JSON-validity of attacker-chosen paths, constrained to those two
file names.
Applications configured with bookmark_store="server" and using
ui.input_file() are affected more seriously. The file-input restore handler
copies files out of the restore directory, so the contents of an
attacker-selected file name within an attacker-selected directory could be read
into the application.
1.4.0 through 1.6.3. Bookmarking was introduced in 1.4.0; earlier releases do not contain the affected code path and are not affected.
Fixed in 1.6.4. Upgrade with:
pip install --upgrade shiny
The fix validates bookmark IDs against an allowlist — a single path segment
matching [A-Za-z0-9_-]+, which cannot express a path separator, a .. parent
reference, or an absolute path — before the ID is used to build a filesystem
path. Bookmark IDs generated by Shiny are unaffected by this restriction.
Restore is additionally gated on the application's bookmark_store setting at a
single point, so it no longer runs when bookmarking is disabled, and the on-disk
restore path is honored only under bookmark_store="server".
There is no configuration change that mitigates this on an affected version:
the restore path ran even with bookmark_store="disable". Deployments that
cannot upgrade immediately can strip the _state_id_ parameter from incoming
query strings at a reverse proxy or load balancer, which prevents the affected
code path from being reached.
Reported by @0xRenSec.
shiny >= 1.4.0, <= 1.6.3Upgrade to a patched release:
shiny 1.6.4Connected by shared product, vendor, weakness, or advisory.
CVE-2023-23946Medium· 6.2Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8
CVE-2022-37906Medium· 6.5An authenticated path traversal vulnerability exists in the ArubaOS command line interface
CVE-2024-13986High· 8.8Nagios XI < 2024R1.3.2 contains a remote code execution vulnerability by chaining two flaws: an arbitrary file upload and a path traversal in the Core Config Snapshots interface
CVE-2023-7260High· 7.5Path Traversal vulnerability discovered in OpenText™ CX-E Voice, affecting all version through 22.4
CVE-2023-7249Critical· 9.8Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in OpenText OpenText Directory Services allows Path Traversal.This issue affects OpenText Directory Services: from 16.4.2 before 24.1.
CVE-2020-3365Medium· 4.3A vulnerability in the directory permissions of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to perform a directory traversal attack on a limited set of restricted directories