Authenticated File Write in NewNotebook API Leading to Data Corruption

Executive Summary

CVE-2026-18640 is a directory traversal vulnerability in the Velociraptor tool's NewNotebook API. It allows an authenticated user with NOTEBOOK_EDIT permission to write notebook records outside their organization's data store directory. The API fails to sanitize parameters properly, enabling overwriting of metadata files like ACL records or hunts if they have a '.json.db' extension. This can corrupt these files and cause data corruption.

Useful 0 Not Useful 0

Detection Guidance

Check Velociraptor logs for suspicious notebook creation or file write operations outside the designated data store directory. Look for files with the '.json.db' extension created by users with NOTEBOOK_EDIT permission. Review API access logs for unauthorized parameter manipulation in the NewNotebook API.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to data corruption by allowing unauthorized overwriting of critical files such as ACL records or hunts. An attacker with NOTEBOOK_EDIT permission could disrupt operations, cause system instability, or render data inaccessible. The attack requires at least the 'analyst' role to create new notebooks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data modification or corruption, which may violate compliance requirements under GDPR (data integrity) and HIPAA (data integrity and availability). Unauthorized access to metadata files could expose sensitive information or disrupt audit trails.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Velociraptor to version 0.77.2 or later to patch the vulnerability. Restrict NOTEBOOK_EDIT permissions to only trusted users. Monitor file system changes in the data store directory and audit notebook creation events. Implement file integrity monitoring to detect unauthorized file modifications.

Useful 0 Not Useful 0