Data Corruption Vulnerability in NewNotebook API by Velociraptor

CVE-2026-18640

What is CVE-2026-18640?

The NewNotebook API contains a vulnerability that allows authenticated users with the NOTEBOOK_EDIT permission to write files outside of the designated data store directory. This exploitation occurs due to inadequate sanitization of user-supplied parameters. Although the written file must have a '.json.db' extension, it can overwrite critical metadata files, such as ACL records or hunt files, potentially leading to data corruption and loss of integrity within the system. It is crucial for users to assess their exposure and apply necessary security measures to mitigate this risk.

References