---
id: "CVE-2026-114140"
kind: "vulnerability"
aliases: ["CVE-2026-114140", "GHSA-pjvx-prjx-h659"]
title: "nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc"
severity: "high"
cvss: 8.8
epss: 0.0031300000846385956
exploited: false
status: "open"
category: "package"
products: [{"name": "nbconvert", "fixed": ["7.17.2"], "affected": ">= 5.4.0, <= 7.17.1", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["ci", "cwe-22", "jupyter", "nbconvert", "package", "python", "self-hosted"]
not_affected_if: ["default-config"]
published_at: "2026-10-21T21:17:56+00:00"
first_seen_at: "2026-10-23T19:11:31+00:00"
updated_at: "2026-10-23T21:57:29+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-pjvx-prjx-h659", "first_seen_at": "2026-10-23T19:11:31+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114140", "first_seen_at": "2026-10-23T21:57:29+00:00"}]
---

# nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc

nbconvert up to 7.17.1 lets a malicious notebook set an output filename with path traversal, so converting it to markdown, LaTeX, rst or asciidoc writes files outside the output directory. An attacker who gets a victim to run nbconvert on a crafted .ipynb can overwrite arbitrary files the victim can write, such as authorized_keys.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:nbconvert affected >= 5.4.0, <= 7.17.1 fixed 7.17.2

## How to check

pip show nbconvert or python -c "import nbconvert; print(nbconvert.__version__)"
If the version is 5.4.0 through 7.17.1, you are exposed when converting untrusted notebooks with --to markdown, latex, rst or asciidoc.

## Fix

Upgrade to nbconvert 7.17.2 or later.
Until then, only convert notebooks you trust.

## Timeline

- 2026-10-23T19:11:31+00:00 ghsa https://github.com/advisories/GHSA-pjvx-prjx-h659
- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114140

## From the sources

### Summary

nbconvert <= v7.17.1 has an arbitrary file write vulnerability due to a path traversal in ipynb cell output metadata, more specifically on the filename attribute.

Vulnerable converters : `--to markdown`, `--to latex`, `--to rst`, `--to asciidoc`.

In `ExtractOutputPreprocessor`, `extractoutput.py:116-119` joins attacker-controlled  `path` to `output_files_dir` with no canonicalization check, enabling arbitrary file write.

This is a sibling vulnerability of https://github.com/advisories/GHSA-4c99-qj7h-p3vg.

### Impact

If a victim runs nbconvert on a malicious ipynb file, it can create some files with arbitrary data in arbitrary locations, i.e. override authorized_keys.

Note that running the cell with jupyter overrides the output, so it would "clean up" malicious cells.

### PoC

In a ipynb file:

```json

"cells": [{
        "cell_type": "code", "id": "abc123", "execution_count": 1,
        "metadata": {}, "source": "# PoC",
        "outputs": [{
            "output_type": "display_data",
            "metadata": {
                "filename": "../../../tmp/PWNED.png"  # ← traverses outside output_dir
            },
            "data": {
                # minimal valid PNG (1×1 pixel)
                "image/png": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg=="
            }
        }]
    }]

```


### Patches

Fixed in 
- https://github.com/jupyter/nbconvert/commit/ce4bd99aec31d81d759fa8eeb8643179392ec66f
- [7.17.2](https://github.com/jupyter/nbconvert/releases/tag/v7.17.2)

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_