Executive brief
The Rust OneNote File Parser, a library used to process Microsoft OneNote files, contains a flaw in how it handles notebook table-of-contents files. An attacker could provide a specially crafted file that forces the software to access files outside of the intended directory on the host system. While the software will not directly reveal the contents of these files, an attacker could use this to confirm if specific files exist or cause the application to crash or slow down by targeting large or system-specific files.
Technical details
A path traversal vulnerability (CWE-22) exists in the `Parser::parse_notebook` function of the `onenote_parser` Rust crate. The parser reads entry names from `.onetoc2` files and joins them with the notebook's base directory without validating that the resulting paths remain within the intended directory. An attacker can exploit this by providing a crafted table-of-contents file containing absolute paths or parent-directory ('..') components. While the parser bails out if the target file is not a valid OneNote section, an attacker can still perform file-existence probing and trigger denial-of-service by targeting large or special system files. The issue is fixed in version 1.1.1 by implementing path canonicalization and rejecting invalid path characters.
Affected products
- msiemens onenote_parser < 1.1.1
Timeline
- 2026-05-15: patched: Version 1.1.1 released
- 2026-05-16: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: CVE published to NVD