CVE-2026-108258 in Shiny
Summary
by MITRE • 10/10/2026
Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied state_id and joins it into the server-side shiny_bookmarks directory without validating that it is a single safe path segment. An unauthenticated request can use parent-directory segments or an absolute path to make the server open input.json and values.json outside the bookmark store, even when bookmark_store is set to disable. In applications configured with bookmark_store set to server and using ui.input_file(), the restore handler can additionally copy and expose an attacker-selected file from an attacker-selected directory. This issue is fixed in version 1.6.4.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/10/2026
The vulnerability identified within Shiny for Python versions ranging from 1.4.0 to 1.6.4 constitutes a critical path traversal flaw that allows unauthenticated attackers to access sensitive server-side files and potentially exfiltrate user-uploaded data. This security defect resides in the bookmark restore functionality, which is designed to allow users to save and later retrieve their application state. The core technical failure stems from insufficient validation of the client-supplied state_id parameter before it is used by the server to construct file paths within the shiny_bookmarks directory. Specifically, the framework fails to ensure that this identifier represents a single safe path segment, thereby permitting the injection of parent-directory traversal sequences such as dot-dot-slash or absolute path specifications.
When an attacker submits a maliciously crafted state_id containing these traversal elements, the server-side logic joins it directly into the file system path without sanitization. This lack of validation enables the application to open and read input.json and values.json files located outside the intended bookmark store directory. The severity of this issue is exacerbated by the fact that it remains exploitable even when the bookmark_store configuration is explicitly set to disable, indicating a fundamental flaw in how the restore handler processes inputs regardless of high-level security settings. This behavior aligns with CWE-22, which defines Improper Limitation of a Pathname to a Restricted Directory, as well as CWE-73, External Control of File Name or Path, highlighting the failure to enforce strict boundaries on file system access based on user input.
Beyond simple information disclosure through path traversal, this vulnerability presents additional risks in specific application configurations. In environments where bookmark_store is set to server and the user interface utilizes ui.input_file(), the restore handler exhibits a more severe behavior by copying files from arbitrary directories selected by the attacker. This capability allows an adversary not only to read existing sensitive data but also to copy and expose files of their choosing, potentially leading to significant data leakage or further system compromise depending on the permissions associated with those target files. The ability to manipulate file operations in this manner reflects aspects of ATT&CK technique T1083, File and Directory Discovery, as well as T1560, Archive Collected Data, if the copied files are subsequently exfiltrated from the server.
The operational impact of this vulnerability is substantial for any organization deploying Shiny applications with bookmarking features enabled or even partially configured. Attackers can bypass intended access controls to view internal application states, potentially revealing sensitive user inputs, session tokens, or other confidential data stored in JSON format. In configurations allowing file operations, the risk escalates to include unauthorized access to server files that may contain credentials, proprietary code, or personal identifiable information. This undermines the integrity and confidentiality guarantees expected from web applications built on this framework.
To mitigate these risks, organizations must immediately upgrade Shiny for Python to version 1.6.4 or later, where this path traversal flaw has been addressed through improved input validation and stricter enforcement of directory boundaries. Until an upgrade is feasible, administrators should consider disabling the bookmark restore functionality entirely if it is not strictly required by business operations. Additionally, implementing web application firewalls with rules capable of detecting and blocking common path traversal patterns in query parameters can provide a layer of defense-in-depth. It is also advisable to review server configurations to ensure that file permissions restrict access to sensitive directories, minimizing the potential impact should similar vulnerabilities be discovered in other components of the stack.