CVE-2026-18640

7.1 Élevée

Publiée le 11/08/2026 à 18:17 · Modifiée le 28/08/2026 à 23:17 · En attente d'analyse NVD · Source : cve@rapid7.com

Description

The NewNotebook API does not sufficiently sanitize its parameters allowing an authenticated user with NOTEBOOK_EDIT permission to write the notebook record outside the org's data store directory. The file written must have an extension of ".json.db" but can otherwise overwrite other metadata files (such as ACL records, hunts etc). This can corrupt these files and cause data corruption.

Traduire en français

Produits concernés

Rapid7 Velociraptor

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.1 Élevée	cve@rapid7.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L`

Faiblesses (CWE)

CWE-22

Références

http://docs.velociraptor.app/announcements/advisories/cve-2026-18640/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories