CVE-2026-18640: Velociraptor directory traversal via the NewNotebook API
The NewNotebook API does not sufficiently sanitize its parameters allowing an authenticated user with NOTEBOOKEDIT permission to write the notebook record outside the org's data store directory. The file written must have an extension of ".json.db" but can otherwise overwrite other metadata files (such as ACL records, hunts etc). This can corrupt these files and cause data corruption.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18640?
CVE-2026-18640 has a severity rating of 7.1, which is classified as high.
How do I fix CVE-2026-18640?
To fix CVE-2026-18640, ensure that the NewNotebook API properly sanitizes its parameters to prevent directory traversal.
What type of vulnerability is CVE-2026-18640?
CVE-2026-18640 is a path traversal vulnerability allowing unauthorized file writing.
Who is affected by CVE-2026-18640?
Authenticated users with NOTEBOOK_EDIT permission in Velociraptor are affected by CVE-2026-18640.
What impact does CVE-2026-18640 have on systems using Velociraptor?
CVE-2026-18640 allows attackers to overwrite metadata files outside the intended data store, potentially leading to loss of data integrity.