Affected: PyPI: nbconvert

# Arbitrary File Write via Path Traversal in Cell Attachment Filenames

## Summary

nbconvert allows arbitrary file writes to locations outside the intended output directory when processing notebooks containing crafted cell attachment filenames. The `ExtractAttachmentsPreprocessor` passes attachment filenames directly to the filesystem without sanitization, enabling path traversal attacks. This vulnerability provides complete control over both the destination path and file extension.

## Impact

This vulnerability allows writing files with arbitrary content to arbitrary filesystem locations, limited only by the permissions of the process running nbconvert. The attacker controls: - Full destination path (via `../` traversal) - Filename - File extension - File content

## Patches

- upgrade to nbconvert v7.17.1

## Workarounds

disable ExtractAttachmentsPreprocessor by setting:

```python c. ExtractAttachmentsPreprocessor.enabled = False ```