Description (CNA)
Local File Inclusion in dagster._grpc.impl.get_notebook_data in Dagster 1.10.14 allows attackers with access to the gRPC server to read arbitrary files by supplying path traversal sequences in the notebook_path field of ExternalNotebookData requests, bypassing the intended extension-based check.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / n/a | affected n/a |
CWE
No CWE identifiers supplied.
References
- https://github.com/dagster-io/dagster
- https://github.com/dagster-io/dagster/pull/30002
- https://www.gecko.security/blog/cve-2025-51481
ADP enrichment
No English description supplied.
No references supplied.