photfun (>=0.1.0, <=0.1.15), pycompound (>=0.0.9, <=0.1.22) +4 more potentially affected by CVE-2026-108258 via shiny (1.4.0)

shiny PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on shiny and may be impacted: - photfun =0.1.0, =0.0.9, =0.0.1a0, =0.2.1, =0.1.2, =0.1.3 Source cves: CVE-2026-108258 Source advisory: OSV:PYSEC-2026-4300...

Shiny for Python has path traversal in bookmark restore

ImpactShiny for Python's bookmark-restore path accepted a client-supplied stateidquery-string value and joined it into the server-side bookmark directory/shinybookmarks/ without validating it. A value containing ..path segments, or an absolute path, could therefore cause the server to open andpar...

PYSEC-2026-4300 Shiny for Python has path traversal in bookmark restore

Impact Shiny for Python's bookmark-restore path accepted a client-supplied stateid query-string value and joined it into the server-side bookmark directory /shinybookmarks/ without validating it. A value containing .. path segments, or an absolute path, could therefore cause the server to open an...

CVE-2026-108258

Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied stateid and joins it into the server-side shinybookmarks directory without validating that it is a single safe path segment. An unauthenticated...

Shiny for Python has path traversal in bookmark restore

Impact Shiny for Python's bookmark-restore path accepted a client-supplied stateid query-string value and joined it into the server-side bookmark directory /shinybookmarks/ without validating it. A value containing .. path segments, or an absolute path, could therefore cause the server to open an...

GHSA-47C3-HPMG-7J6P Shiny for Python has path traversal in bookmark restore

Impact Shiny for Python's bookmark-restore path accepted a client-supplied stateid query-string value and joined it into the server-side bookmark directory /shinybookmarks/ without validating it. A value containing .. path segments, or an absolute path, could therefore cause the server to open an...

photfun (>=0.1.0, <=0.1.15), pycompound (>=0.0.9, <=0.1.22) +4 more potentially affected by CVE-2026-108258 via shiny (1.4.0)

shiny PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on shiny and may be impacted: - photfun =0.1.0, =0.0.9, =0.0.1a0, =0.2.1, =0.1.2, =0.1.3 Source cves: CVE-2026-108258 Source advisory: GHSA-47C3-HPMG-7J6P...

photfun (>=0.1.0, <=0.1.15), pycompound (>=0.0.9, <=0.1.22) +4 more potentially affected by CVE-2026-108258 via shiny (1.4.0)

shiny PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on shiny and may be impacted: - photfun =0.1.0, =0.0.9, =0.0.1a0, =0.2.1, =0.1.2, =0.1.3 Source cves: CVE-2026-108258 Source advisory: OSV:GHSA-47C3-HPMG-7J6P...

CVE-2026-108258 Shiny for Python - Path traversal in bookmark restore

Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied stateid and joins it into the server-side shinybookmarks directory without validating that it is a single safe path segment. An unauthenticated...

EUVD-2026-95986

Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied stateid and joins it into the server-side shinybookmarks directory without validating that it is a single safe path segment. An unauthenticated...

CVE-2026-108258

Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied stateid and joins it into the server-side shinybookmarks directory without validating that it is a single safe path segment. An unauthenticated...

photfun (>=0.1.0, <=0.1.15), pycompound (>=0.0.9, <=0.1.22) +4 more potentially affected by CVE-2026-108258 via shiny (1.4.0)

shiny PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on shiny and may be impacted: - photfun =0.1.0, =0.0.9, =0.0.1a0, =0.2.1, =0.1.2, =0.1.3 Source cves: CVE-2026-108258 Source advisory: MEND:CVE-2026-108258...

CVE-2026-108258 Shiny for Python - Path traversal in bookmark restore

Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied stateid and joins it into the server-side shinybookmarks directory without validating that it is a single safe path segment. An unauthenticated...

CVE-2026-108258 Shiny for Python - Path traversal in bookmark restore

Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied stateid and joins it into the server-side shinybookmarks directory without validating that it is a single safe path segment. An unauthenticated...

CVE-2026-108258

Shiny for Python versions 1.4.0 through 1.6.4 are vulnerable to a path traversal flaw in the bookmark restore functionality. The application fails to validate that the client-supplied state_id is a single safe path segment before joining it with the server-side shiny_bookmarks directory. This all...

PT-2026-109313

Name of the Vulnerable Software and Affected Versions Shiny for Python versions 1.4.0 through 1.6.3 Description The bookmark restore process accepts a client-supplied state id query-string value and joins it into the server-side bookmark directory without proper validation. An unauthenticated...

CVE-2026-108258: Improper Limitation of a Pathname to a Restricted Directory

Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied stateid and joins it into the server-side shinybookmarks directory without validating that it is a single safe path segment. An unauthenticated...

Posit Shiny for Python: Path traversal vulnerability

Posit Shiny for Python versions 1.4.0 to 1.6.4 had a path traversal vulnerability. This vulnerability stemmed from the bookmark restoration function’s acceptance of stateid provided by the client. The function did not verify whether it was a single secure path segment before appending it to the...

djangocms-lab-carousel (0.2.1), djangocms-shiny-app (0.1.3) potentially affected by CVE-2026-54623 via django-cms (3.1.7)

django-cms PYPI version 3.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - djangocms-lab-carousel 0.2.1 - djangocms-shiny-app 0.1.3 Source cves: CVE-2026-54623 Source advisory: OSV:PYSEC-2026-3822...

djangocms-lab-carousel (0.2.1), djangocms-shiny-app (0.1.3) potentially affected by CVE-2026-54622 via django-cms (3.1.7)

django-cms PYPI version 3.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - djangocms-lab-carousel 0.2.1 - djangocms-shiny-app 0.1.3 Source cves: CVE-2026-54622 Source advisory: OSV:PYSEC-2026-3820...