CVE-2026-108258 | Posit Shiny up to 1.6.3 Bookmark Restore restore handler state_id path traversal

October 9, 2026 Yanac

A vulnerability labeled as problematic has been found in Posit Shiny up to 1.6.3. This affects the function restore handler of the component Bookmark Restore. Such manipulation of the argument state_id leads to path traversal.

This vulnerability is documented as CVE-2026-108258. The attack can be executed remotely. There is not any exploit available.

The affected component should be upgraded.VulDB Recent EntriesRead More