CVE-2026-108258 posit-dev CVE debrief

Who should care

Defenders responsible for Shiny for Python deployments, particularly those using `bookmark_store='server'` and `ui.input_file()`, should assess exposure and prioritize remediation.

Why it matters

CVE-2026-108258 is a path traversal vulnerability in Shiny for Python's bookmark-restore feature. Defenders should verify affected versions, restrict access, and monitor for potential probes. Remediation is critical for systems using specific configurations.

• Unauthenticated server-side probing for file existence and JSON validity
• Potential reading of attacker-selected file contents within attacker-selected directories
• Verification of affected versions and configurations required
• Remediation priority for systems using `bookmark_store='server'` and `ui.input_file()`

Technical summary

Shiny for Python's bookmark-restore feature is vulnerable to path traversal. A client-supplied `_state_id_` query-string value is joined into the server-side bookmark directory without validation, allowing an attacker to probe for the existence and JSON-validity of attacker-chosen paths. The vulnerability affects Shiny for Python versions 1.4.0 through 1.6.3, and defenders should prioritize verifying affected versions and upgrading to 1.6.4 or later. Systems using `bookmark_store='server'` and `ui.input_file()` require immediate attention.

Defensive priority

Defenders should prioritize verifying affected Shiny for Python versions and upgrading to 1.6.4 or later. Systems using `bookmark_store='server'` and `ui.input_file()` require immediate attention.

Recommended defensive actions

• Verify Shiny for Python version and upgrade to 1.6.4 or later if necessary
• Review and restrict access to bookmark restore functionality
• Monitor for potential unauthenticated server-side probes
• Confirm whether affected Shiny for Python deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The source corpus provides details on the path traversal vulnerability in Shiny for Python's bookmark-restore feature. Evidence is based on official CVE Program and NVD records, as well as source references from GitHub.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.